Malware Analysis Report

2025-01-22 19:57

Sample ID 241016-weq99axapj
Target e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N
SHA256 e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0

Threat Level: Likely malicious

The file e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4614) files with added filename extension

Renames multiple (3140) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 17:50

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 17:50

Reported

2024-10-16 17:52

Platform

win7-20240903-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"

Signatures

Renames multiple (3140) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\bin\jfr.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\UnregisterBlock.3gpp.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\bin\t2k.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\README.txt.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Pipeline.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\SyncRemove.wmf.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe

"C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"

Network

N/A

Files

memory/1564-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 61a1898199f39cd90ea4297833897876
SHA1 3d95df1da6935cc199921f414d5a3f1786df522b
SHA256 d7d2e3197020371d658e9f919c62226da1f1f40f1e3530be1368b16db69fd9c2
SHA512 2b5f92dba1cf87444849b7b379335185811827151d93d060656370e81a106424c6594177a3924ea70979c6453117b7ef0caeec2fc5cfff08caee92c7058b6359

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 8fdf25c9c8b488d17eca607d520a2abb
SHA1 83d4b6a03ce3f24300b064235ee4282b642a8644
SHA256 01da03a45be305f8f3451c77c596ab12e0b11b9df783c752295c942003af17ed
SHA512 a900d470cf6ae1a0141073be0ccf6e6d7dd6640283bf47525132b835e9b2fb6bfdcd1fe87fbd4f273802c2bf31e1eb18de6870a4871c26c2c3ca61d349957ca5

memory/1564-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 17:50

Reported

2024-10-16 17:52

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"

Signatures

Renames multiple (4614) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe

"C:\Users\Admin\AppData\Local\Temp\e51de51a6039f8757082d5b3fabbe5482551345c80516920d636e848b9b23ee0N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/4296-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

MD5 ddeca87e0d66c831f67f70e103639273
SHA1 a4050971e6357099626f0fa87c880246d80dd33b
SHA256 63c7c6fc5f171eb27c30ed88c7f54c5173d48e6514bff06a707fa5aa1be692d3
SHA512 9596cc23f8546af296044efa06dffa034f6a947363e881b2ce942e6d9a54b85868b5238c9001b4a09d6b3ab51d7173cd245123792c0bce709556ad5af0ae2cc9

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 09b9c5067d0b5c2fe0ab50ecaf98e593
SHA1 b7399ad15052b5fa33d3345a88ba2b63208d18a7
SHA256 8442fe20168320c0bb57514d83505b43715c12f70ae1aedc370e90957282c0e6
SHA512 b2392d95d4238ebc0a53dc56891d549fd460cde37006fb5cc0a77a27c05f355920de834d7a93c646343cffdb064a98ca458561b9d002f00c6ae1981542869330

memory/4296-666-0x0000000000400000-0x000000000040B000-memory.dmp