Malware Analysis Report

2025-01-22 19:54

Sample ID 241016-y292zszhna
Target 0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N
SHA256 0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04

Threat Level: Likely malicious

The file 0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3329) files with added filename extension

Renames multiple (4649) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 20:18

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 20:18

Reported

2024-10-16 20:20

Platform

win7-20240729-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe"

Signatures

Renames multiple (3329) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\MET.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Services\verisign.bmp.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe

"C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

MD5 37d640c36377a832ab26ea1ad809648a
SHA1 0ceeb269b8d85868c84b73353126a2494575d8f2
SHA256 90cc11f728629618c4865e1a718baf03a9813518cd1bb3cbf5a00d56ca297b1d
SHA512 31c7924fe8a52656e21d9e587901d8367a0a4c3d60b6781602b74646123f0d6012379505765e1080c3c159b51301a76e7e9c94977152d9c682732f2bf8839379

memory/2744-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 fc2602e4bc37e62856a46df1d1ced9ce
SHA1 8b7b86f6ec03a49a60ce853d3f599c956613f59a
SHA256 0ea773e227edce747b5aa63698418d6b69b1f460453b2cf8e4cbbf89bc75202a
SHA512 83480ca6da77f0aefa28a7085b39856d7478be88405e55f120ff3696950a6cb0c5117546cabfbb7ee5559a2652d2d3ee21337b6a087f4f8a41f400d83a22d1bc

memory/2744-69-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 20:18

Reported

2024-10-16 20:20

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe"

Signatures

Renames multiple (4649) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe

"C:\Users\Admin\AppData\Local\Temp\0fc4ce29a2933710fae379e117da111772381071e07c1cb3019342b15e484a04N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 5.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/4620-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 6db5a550d2a1d5c7056bcb2a45d31f4c
SHA1 c2f824c779b07ceb9692abbf04832ecf083bade8
SHA256 1836a49bf7b093c70843826cc2d57ab5a4cdbb5733eccef4aa3d19685111b276
SHA512 375e04a4735853b84832ce1b782b18d24a7796bf636ec7361132f598299beba26b2ed29fe0dc3803a4648054fc221e337cc005ccf10abce9b9b19198ba69405c

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 6b74421fcfa928eeda3e6571fd4de017
SHA1 fc9c7791431e26500bea2ea3dc771e3e525534c8
SHA256 150d365545f96e85f4bfab5d6d75601187522ffe69c64c8ac14b192e5fe789b7
SHA512 a60b8cea815982f06a9034a7f72b09966e9d04454f62421c40d501005a9222e80313cb6e40c490f7764ecad7fe4f48f0d4b2fab778eaf855c278e21377ebb6a9

memory/4620-666-0x0000000000400000-0x000000000040A000-memory.dmp