Malware Analysis Report

2024-10-24 18:21

Sample ID 241018-cc1lcssgpk
Target 3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N
SHA256 3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5

Threat Level: Likely malicious

The file 3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3632) files with added filename extension

Renames multiple (4687) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 01:56

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 01:56

Reported

2024-10-18 01:59

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe"

Signatures

Renames multiple (3632) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Internet Explorer\pdm.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe

"C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe"

Network

N/A

Files

memory/3068-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

MD5 149d8a7cc702a7b82923c5ccae891c89
SHA1 3a327becf380a02118a0f5251142e4eeb2afbf62
SHA256 5faf1ee7f366a0a6ab164e7a07c7e1c2a3b632ac47d7ce55138b99c403962c65
SHA512 9561fd074bbb30acbf2ee768879e1d019c34e4d425671227103f8c6a3e2e2bf4b6df960bc33005f45325758913b6e3bce9d661c214d1e622a9627ac1f7439d00

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e8f5fc422abad579139de73f66d15105
SHA1 eb02cdee0a467577aee4140a84fe5f33d449a96e
SHA256 a939a98cd4767b99dd5ef0ff602452f13b0557fe1e829ccf4ce90a30e237defc
SHA512 2f718a8031fcdd511f63a45452efbb422bae00669756f7d1ebd021e22e02ace3ae029d24b009cf42d856fe1e4fb0fececa67124f1f8b16a051099a051d0b6c24

memory/3068-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 01:56

Reported

2024-10-18 01:59

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe"

Signatures

Renames multiple (4687) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe

"C:\Users\Admin\AppData\Local\Temp\3cb0ed152f8912fbde17ca5ae35692690f79cccc9c7b963b1b69d8a026fbcce5N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 72.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/3716-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

MD5 ab0ea09cc10827c1a00e5996d148c292
SHA1 87c63eca3a7c875872933334bf3fd38f41f7d563
SHA256 c8b2e93bc343fd5de74d5bd14ddf1c8df17981d99c2eb557754397c383cd6b48
SHA512 364b8a9a0c623a62cdb4bebd8f01c9e5905663766cc4c941b60d3d26b6d42401e184f4f657580ea55e6b6fc48bf1cecd87f3aecadc3dbdf1e5e8413328c729b3

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 2d782a1e464c3865ee27f1d3ed9118ee
SHA1 83b3d9e11c5e6e84e99f2706c0677f88bef37be4
SHA256 a94b538cc2f46ad86fe0592b37781490ec0f0efbeb3a03fd12f6c7cd04fe94fd
SHA512 37166943a46e017b3f287876015a60af36c9d441f8ecb744ac27316ae59fef58602a7d4627317b3c2b32a8e435a81c56f44eeb87c6348b1f456af5e8bdbfff26

memory/3716-666-0x0000000000400000-0x000000000040B000-memory.dmp