Malware Analysis Report

2025-03-15 08:16

Sample ID 241016-fbq73sxdlq
Target c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9
SHA256 c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9

Threat Level: Likely malicious

The file c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (5191) files with added filename extension

Renames multiple (1041) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 04:42

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 04:42

Reported

2024-10-16 04:44

Platform

win7-20241010-en

Max time kernel

150s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe"

Signatures

Renames multiple (1041) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\rtstreamsource.ax.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe

"C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe"

Network

N/A

Files

memory/2820-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 275298eb865d313be2eb7e308a26731f
SHA1 9d824f77fe97cae1820856473e85a9709f9cbff9
SHA256 432b87ee873cb72aba64795b1aace57e35ec95e91e34273f6d6ff3195c437086
SHA512 5576e0d4634a12f658e895329106af72d215cc7ddeedbf057bb94c36a0695eabb34a8fc42c2c5ae7d7944458001d42c1a7091ce8ed19a0b4a178c262c779e0f8

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 3f128fa9979cae7f7ba4c15a4af40802
SHA1 432308c6f2cd4d6c4be186b954a3fb0ad3b5f8da
SHA256 8882f310e6bb2c98912b665b53e5bbfd4afdedabe29b735a5e01c47a7ecef468
SHA512 b31470439c2bdeef5f48c2948c57cf84f0411364265d9a27515cfbc63df3b98f1ea505c910f00e7cea99a330a117fb820496f53593f799a0ebb0c091fdf575af

memory/2820-19-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 04:42

Reported

2024-10-16 04:44

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe"

Signatures

Renames multiple (5191) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe

"C:\Users\Admin\AppData\Local\Temp\c51b909fa98e216faed878480a96c0f7da4e54a6c76a460076178a5cb9fe4ec9.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/3180-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 57c73dac57809c66ffc43cf5d548ebc3
SHA1 2b5d2ab47788c2c2da587affa621942ea913a1ca
SHA256 6f45d3abc0e18cc0cf1ac595e8d32f1da047295a025fb2810b3b46c7b36919ee
SHA512 c9977d4af46c393efa37a3cf63265066dc80b7ed9b08dc298a10c48eb3ff200311c7b2e7b1a0537f6f274e330d0f17fa977340edc6d7caa3c5bcd714aa33cbec

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 f8de8a2dffe22138954c426b66e64233
SHA1 034dfcadaa09a2604c460448f2936f2d9bf5eedd
SHA256 5cd2a10eb689b7160c2da974500c5ae3c8dd349c1cd538fe0976143e702b3dd4
SHA512 f1d7ac2d61f6cf9ce4d49e1be9a7dfc2b7081de13cdbe074d8be971ed06481824655f8416c726f185c379b7c0d2f42ee7b743b4d41e29768fd338d3444435082

memory/3180-784-0x0000000000400000-0x000000000040A000-memory.dmp