Malware Analysis Report

2025-01-22 23:11

Sample ID 241204-v7yz5aylgn
Target fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe
SHA256 fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10df
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10df

Threat Level: Known bad

The file fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload family

Banload

Renames multiple (225) files with added filename extension

Renames multiple (507) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-04 17:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-04 17:38

Reported

2024-12-04 17:40

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Renames multiple (225) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\AssertSync.mhtml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Outlook Thread Manager" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OLMAPI32.DLL" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe

"C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"

Network

N/A

Files

memory/1720-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1720-1-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/1720-8-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/1720-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1720-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1720-13-0x0000000002FE0000-0x00000000031EC000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 67dc575eab4a5588a8d8495f8409ebba
SHA1 ff3ee1b64b313c87b965c891da26d8c84de51668
SHA256 304abdfea0d4fe7b8e1ef816d4dd023eb7d758b38b37588a8405a4a0e84acc84
SHA512 338a752df550bcfa4e4c6a861fb4da63c25b0ddf8aa2e495f1b8e1b6e0edf8d986700c13dbe7c9a3a7c5a9cda11a111e13738748a935d049881e5024f35e82b8

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 45c3e5478a8aafb2e3693e3c44107db8
SHA1 8fb1253be6dafeb88fc7cd5c6efd229bbe8bcaf2
SHA256 56921890a9bec0887c8c728660d74af2fed20d7d61538f988936e278b1df5e4f
SHA512 220bdb4f41f66464082ed318b99e8aad6d9e3acff43b79aac3db9d7bc67714a54e495992cac12aa765b63c8a55793128d8ffaa91234c2d37f057e6e971393bf2

memory/1720-25-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/1720-26-0x0000000002FE0000-0x00000000031EC000-memory.dmp

memory/1720-43-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1720-55-0x0000000002FE0000-0x00000000031EC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-04 17:38

Reported

2024-12-04 17:40

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Renames multiple (507) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "ImeDicAPIProxy" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "C:\\Windows\\SysWOW64\\IME\\SHARED\\imedicapiccps.dll" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe

"C:\Users\Admin\AppData\Local\Temp\fe864ca1ed2d02f2ab3e42ec2dfcea0d7fb4d1aece9344612f6f66f739be10dfN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1200-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1200-2-0x0000000004290000-0x000000000449C000-memory.dmp

memory/1200-9-0x0000000004290000-0x000000000449C000-memory.dmp

memory/1200-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1200-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1200-14-0x0000000004290000-0x000000000449C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 5240c2f5355e1fc7340c5f35a620f170
SHA1 75fda74c9fec5f88adb4a7ed4f56c7bab8e2ebf0
SHA256 0d6aac75e4dccc42c5b91cbf82ba5b992b8b6d0e0ccc1b68ca3179071d7e2f36
SHA512 610909ce961e9b8b50901b5ba8efc6a43a6b1050ead797884d395c95ef7dadac7e285b38123a887826a89721538a773055c41ff9723e83c7f6a06d6dd80281eb

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 3f39a7d74fdedec1bbe280b3d5ff7267
SHA1 a7a9c8ff346009a15807911afee7712e0f85613a
SHA256 70afb9be75ba190ae54e8abfa53ceae434b67cfbb2edfd746397325866011e82
SHA512 c309973e79995a51de4f79e207db264aa0c0de73308cff20fe8011498b978f504c9440ab8f4c2905c6243c8ec4bb677ac672076ef08c7001b0ec4c8a1e3ae1c2

memory/1200-47-0x0000000004290000-0x000000000449C000-memory.dmp

memory/1200-46-0x0000000004290000-0x000000000449C000-memory.dmp

memory/1200-130-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1200-148-0x0000000004290000-0x000000000449C000-memory.dmp