Malware Analysis Report

2025-01-03 08:35

Sample ID 240611-ayhlkaxaqd
Target 90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6
SHA256 90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6
Tags
upx ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6

Threat Level: Known bad

The file 90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6 was found to be: Known bad.

Malicious Activity Summary

upx ransomware

UPX dump on OEP (original entry point)

UPX dump on OEP (original entry point)

Renames multiple (752) files with added filename extension

Renames multiple (226) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 00:37

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 00:37

Reported

2024-06-11 00:39

Platform

win7-20240215-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe"

Signatures

Renames multiple (226) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\CloseReceive.wav.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\BlockLimit.tmp.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe

"C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe"

Network

N/A

Files

memory/2748-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

MD5 ac771cee77966ee50e7aaefbb93936b6
SHA1 b16260740dd3a8c6e02e999976501f35e1513c65
SHA256 25fd4ee7de67e2b8fae125b7dbc20b4ef9a3a01a231ac728d2fdb2d53582a5ac
SHA512 0a94ba3eb439e49c20908c3ed128f33351b17bb4c5dcffd34b1242d3c05fc465bafa6f0a92a0d4096b0054c1fae6e466748079d8d02c4e5439953b2df93f75c5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 f3a0972908ab613f9b16904ec44627f4
SHA1 94744b702bbc26ad80f2b456906b111e18108031
SHA256 53785eca2303cdcba766513fb0e59eb1b4ef449028f9904898e3eda0067a01c4
SHA512 54af96d39645cae56765bdc0205d9b72d062468c837d1bfc427ed79b6deeef3c9262d230d60fdb84b608dbe41869baa2795751bc9a977520ff11dd33d3bc5603

memory/2748-98-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 00:37

Reported

2024-06-11 00:39

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe"

Signatures

Renames multiple (752) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe

"C:\Users\Admin\AppData\Local\Temp\90f71aa2da95120094a42bf392adab5a7b7a0f92e00df9616be7b714579876d6.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8

Network

Files

memory/2112-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

MD5 747ab1477a943e33ccc138f7d5726cdb
SHA1 821783bf57a1eaa191ce0a6bbd0c1577a3ad45e8
SHA256 7ff8d65228ed6d440f949bae41edf943ee0692d3eb619a90516a6e832c73387c
SHA512 001e57985c8e82d0aff52cd91fd20f11fe9a923bb4f84e26d2787ced4cdc642005b6ec97dae42b295fa231e2843cf5c868aecbc78474f65aa48ac5fd5a95a5b5

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 37e5d9eedcf37142666a3d3cdadf4816
SHA1 39bc645c3a1e5da056bf38a07ec48f5308608849
SHA256 e6486a4edafab1b436b1b90f55a6193e3a4aea5ddb26b7242cbd898b6f313276
SHA512 60f23c85e4d85afa769a56406022e87e80d327eb495b96f3663f1f417ba44d5e8f01abff2ca4a4462abc78cd329f8d2321e5c4672e29c07439a1cf2f7530063d

memory/2112-308-0x0000000000400000-0x000000000040B000-memory.dmp