Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-xp378sxqhw
Target 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca
SHA256 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca

Threat Level: Known bad

The file 91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (816) files with added filename extension

Renames multiple (225) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:02

Reported

2024-12-27 19:05

Platform

win7-20240903-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Renames multiple (225) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "InternetExplorer.Application" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Internet Explorer(Ver 1.0)" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "\"%ProgramFiles(x86)%\\Internet Explorer\\ielowutil.exe\" -CLSID:{0002DF01-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "InternetExplorer.Application.1" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Programmable C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe

"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"

Network

N/A

Files

memory/2692-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2692-1-0x0000000003110000-0x000000000331C000-memory.dmp

memory/2692-8-0x0000000003110000-0x000000000331C000-memory.dmp

memory/2692-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2692-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2692-13-0x0000000003110000-0x000000000331C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 3249cb235bb4e059417bd8a26238fbe2
SHA1 8585e019a5f0ce120ae3d829871f5107726fe07a
SHA256 5ec95fb62c38dc92a4f5412b20e182c9bedaf96824aa553edf33a22f2557cd88
SHA512 1689766f54772e6d05ee5928307ee626f7c4557321fe6c7eb50531217dd6b8cdf208f48439caecb6d73d0ae69566b978e804ae153e943a80852a49cbf50e1c41

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 27555c3a92e4f6582593fd77527764aa
SHA1 f00312fe6504a36a9c81b451a1983f5593fff11e
SHA256 db2d9bf4d03c3336c7baea512dc8f46196bc7016778f11b034a1acdedc6a9019
SHA512 70fc60fdef2963b66a6bcd351880b1cb56a2613e3be253ba7c1e84e64f887e41c31786422df6c9c47c11694ea9b29c3cee1bebd964f48ec4b407c6a7afba3bf4

memory/2692-25-0x0000000003110000-0x000000000331C000-memory.dmp

memory/2692-45-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2692-57-0x0000000003110000-0x000000000331C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:02

Reported

2024-12-27 19:05

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Renames multiple (816) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Crashpad\metadata.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\els.dll" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "PSFactoryBuffer" C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe

"C:\Users\Admin\AppData\Local\Temp\91c57e78c58fe8d4600e8963a262ee1433f79cf09c751991846feeb4449629ca.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

memory/3108-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3108-2-0x0000000004450000-0x000000000465C000-memory.dmp

memory/3108-9-0x0000000004450000-0x000000000465C000-memory.dmp

memory/3108-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3108-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3108-14-0x0000000004450000-0x000000000465C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 601d18587f091c43dde86655fa1f7aa0
SHA1 445ae0b0ec19e5652df77f664cc3a0bec8bd225c
SHA256 96ad24c09671149ae2267dd92d386b1b9df31fa34daeef1fd30029c877022cf4
SHA512 2cde66f89b43734fb0f0acdd706387697289f7df97650741a0546d896a07d00611bb25b382e19391ae3c1ff2b9188384d503faa5f7bff7926e9c9e8c8dc3d049

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 51a776984994ed591a0ca6b49abd93b5
SHA1 2e8ab82f35be742c6e0827b14ba8fcfd9478d5f5
SHA256 b6bce0f177c9f36a5c7844f17d456af7281d1aa3223b79dcd708f373cde9a432
SHA512 afe9de18ebc42df4e4832baa7fe3e261b0d6a7b15c431a9a64d92800a57dea5b6a1692a589f5c105656d135c01b713d6c6c5446168b3e09e4aee027e89c1e211

memory/3108-48-0x0000000004450000-0x000000000465C000-memory.dmp

memory/3108-49-0x0000000004450000-0x000000000465C000-memory.dmp

memory/3108-136-0x0000000000400000-0x0000000000616000-memory.dmp

memory/3108-156-0x0000000004450000-0x000000000465C000-memory.dmp