Malware Analysis Report

2025-01-06 13:04

Sample ID 240617-bddmjswhmg
Target aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f
SHA256 aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f
Tags
upx ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f

Threat Level: Known bad

The file aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f was found to be: Known bad.

Malicious Activity Summary

upx ransomware

UPX dump on OEP (original entry point)

Renames multiple (4818) files with added filename extension

Renames multiple (3624) files with added filename extension

UPX dump on OEP (original entry point)

UPX packed file

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 01:01

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 01:01

Reported

2024-06-17 01:03

Platform

win7-20231129-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe"

Signatures

Renames multiple (3624) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Mozilla Firefox\omni.ja.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_vc1_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\HST.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe

"C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe"

Network

N/A

Files

memory/2360-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

MD5 fd179389f781db25fa50efdc8bd4dc8a
SHA1 0131179d8c33879c4754c9a46c8d36277a1e03d9
SHA256 ef534454707284f66fe94008975ed4e146e13c5acc993afa3347ceca5bd64e1a
SHA512 b9bdb2a34e32743b4f61c5222b7f304376762c8ae9753f37781d6f40dd40f6301a25e4c0929d53ae88362ba34a35c3f5adde3eddcc1ea9f539a5df5df69a6dc5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 dd9f6e045de44ccec5250dd711a7465b
SHA1 e79174b80556b98e6173fb9d63f6e917b1dd5e5b
SHA256 c2b92091c241e17be43a504ac68eab0451f2642d7541940f461234f119b930c6
SHA512 009870bb11ef9a70fb00d951e18cf71392800abcfd7f4dff109fc07328eee3d980e46de1b3e36acad8be4ebc4ae9751babd0729c5ef61b777099fff49c329f24

memory/2360-74-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 01:01

Reported

2024-06-17 01:04

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe"

Signatures

Renames multiple (4818) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe

"C:\Users\Admin\AppData\Local\Temp\aed4fbd692029f714057bcbf46405fb283402872a510ee63d74fd3e18bce480f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/5088-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp

MD5 44400f54a4ea4152d375d6538fe6e69d
SHA1 a6ab14039dd44332aa41781a9c30a7bc2096a486
SHA256 521e03e9966f7035294033fba7b4e10e0661acdfcb0f6af2253bb62e900af929
SHA512 9a3d0b8ff0f8baa5082d17a3bf50365c6c755a8333beac7b0b2ceacaae9175d81c264e69573479d8812652462d8c8a4dd68262ec05c4e026e8c67909db694cd0

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 0bb86b5d71b25c6940f85bf49d9277cd
SHA1 3bb8371d516dbd558c3ad6aaa321956c30169472
SHA256 9567aaadff577656277392ff7d65bcdcce4287efe781a6e5ec09dceeb54365b6
SHA512 f0b4bf586a225f23fe74144cf9438e4e538b2865959dd5cbd54664c74e0f2681c6388e863bfa84152e22d79ab396d1a093f39a49a50bc40a19f76c99f2ac923d

memory/5088-868-0x0000000000400000-0x000000000040A000-memory.dmp