Malware Analysis Report

2025-03-15 08:12

Sample ID 241016-jeqx9szbna
Target f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N
SHA256 f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463

Threat Level: Likely malicious

The file f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (5151) files with added filename extension

Renames multiple (582) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 07:35

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 07:35

Reported

2024-10-16 07:37

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe"

Signatures

Renames multiple (5151) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\CompleteApprove.docm.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe

"C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/3228-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 3ed4b43f309e2d5e834eaeb9a97467c1
SHA1 2a4efceb74f49544c38cf52f14652e0efdfafa11
SHA256 38806c2ca138aafdc62ffab91621cbd56e0e3fe452be40315645beb6b876aacb
SHA512 c1342d59533860f25e20d99e5d9b2cb610bf9fefa432add3bc0e5df496c0948f2dfcbe48cc9d044cac3daabf0d70e1489c254f1da37d60974764536593414b04

C:\Program Files\7-Zip\7-zip.dll.exe

MD5 12947e82605b2d98a65dd828b9ee298f
SHA1 94c0e03b043f3fe35a26a0d9e68afb655a25f74f
SHA256 fec4af6710c6174acf6679c2532b52044d7554cbfdbac5cd760158d9888f4546
SHA512 dad6760656a69458599546f3c8d8a16f575078674bfc86d2ab52185a78d03b02e8ce14b2101f199de33beafa862097aeeedc3cb69e99bde1e0e039e5510f7337

memory/3228-785-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 07:35

Reported

2024-10-16 07:37

Platform

win7-20241010-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe"

Signatures

Renames multiple (582) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Eurosti.TTF.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\OmdProject.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe

"C:\Users\Admin\AppData\Local\Temp\f45acf7a58b90966c32faea63f7105a620d2be9f9371fdd27ced2dd9ef719463N.exe"

Network

N/A

Files

memory/2796-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 1c77c62584e57da6dd5779b90fe9626b
SHA1 9ece135a6b3c35724a2abc02cbb98b17a976c1f1
SHA256 25615ab24c941c260b1a4061a967b1fca5100c68bf559f254b4838b62895e03f
SHA512 0009621ee700b9bd22fd85a9caced95f6fd157bf0db857faf4f3beb91bc392f33058cc729f099230428d456bad1dc66a3ae2d7d83087d53d7ec8f137b78815ac

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 029b3674aa606ae08dd7acd3a3bb70d9
SHA1 f195d57f342e99cfa8375cd31767b9f4feaef266
SHA256 d2ea03f44d401023e5fe9626e51d34e750e5a5859e64ad1d5b672bbd30a94eb3
SHA512 eae070aa83b2fad68003c033101b8e778739d26e4fafdeacc3c02dc80f7c8ac9fbc72cf9c0e2b8832554ed4968961a7495c91e75e283ae75cec65ebd507032f9

memory/2796-20-0x0000000000400000-0x000000000040A000-memory.dmp