Malware Analysis Report

2025-01-03 08:27

Sample ID 240617-c7pscavdpn
Target d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f
SHA256 d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f
Tags
upx ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f

Threat Level: Known bad

The file d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f was found to be: Known bad.

Malicious Activity Summary

upx ransomware

UPX dump on OEP (original entry point)

Renames multiple (3433) files with added filename extension

UPX dump on OEP (original entry point)

Renames multiple (1627) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 02:43

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 02:43

Reported

2024-06-17 02:45

Platform

win7-20240221-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe"

Signatures

Renames multiple (3433) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Defender\MsMpLics.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Media Player\wmlaunch.exe.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe

"C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe"

Network

N/A

Files

memory/2936-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

MD5 892cb9a5db64128af461dda43bd02b09
SHA1 6c221020d64a3748e8f3675381487f2879f55055
SHA256 5edab8c997f8217cc47e474a3f46da34f517b47b2710a728f48b67392dc49f11
SHA512 48e15e7408ea874d5c853120672a3583818294fa4733d154ec2c1685c3e8e04530a38ed1a3e8824c8a973fe9a78b5827c6a22693361ee30cab65c7c429ab37b9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 01eb5143144a28e2635ba5b488350dfe
SHA1 63a096736fdc56ce38ee1c38e837789f61e3b86a
SHA256 1b2fd71ca0cd5b5c807e63131b67dea565afabb48fdd9e9ecff0b051bb1d3fa5
SHA512 aacd28b411b9c5a78be7b6f12c15c838561941497f18061f149fdc340c1d135c7c2ea42a3fd6a5436d5cdf7767e72438e8ddbd305c2efe48f36d2d53bd229978

memory/2936-74-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 02:43

Reported

2024-06-17 02:45

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe"

Signatures

Renames multiple (1627) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.AppContext.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.ZipFile.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.Local.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe

"C:\Users\Admin\AppData\Local\Temp\d40ef947e4c32beb14ce93c0c261bad9bb2b416de4a7095c8984dbc8fa4f238f.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3308 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 13.107.253.67:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

MD5 1480818ca10d0c7f52bedf65c76bf793
SHA1 e8eed9a554297654698fc5780534d2be962ac19e
SHA256 ea7c72e2b956cd9426903db3e242e0bc089d29557ba689d2a2c104473f864ad1
SHA512 b3ba63f89d2394094ff16256897a7e1b34510a5a33c544e75276d67909396d6fc783f41f57cc9babde4285fb1bbf01c0417e0f4302a1d26018b0aac30e42ce07

C:\libsmartscreen.dll.tmp

MD5 fddcf3521e44427e6e3c08f38910956b
SHA1 d398e8282733d92a8e436de486fc48b4c91b45e8
SHA256 dc5b44cdd904ac5eaadd2076e893ea5ad08f6c1d8a91bb7458beef09c09b76f5
SHA512 b4b312c2adcba7c12236d53b4f32389aabf19ec5ad85e6cb87e34d7e8182167f6c792c060598bfb6fa467ce7b3364211b7ea9707a97279f7d714539ef9d2f182

memory/2548-280-0x0000000000400000-0x000000000040A000-memory.dmp