Malware Analysis Report

2024-10-24 18:19

Sample ID 241018-d7llcsvemc
Target dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN
SHA256 dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064db
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064db

Threat Level: Likely malicious

The file dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (4445) files with added filename extension

Renames multiple (2904) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 03:39

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 03:39

Reported

2024-10-18 03:41

Platform

win7-20240903-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"

Signatures

Renames multiple (2904) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Internet Explorer\images\bing.ico.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\GMT.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe

"C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"

Network

N/A

Files

memory/1648-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

MD5 d445062faeb6e7c42505bfd6c6714ffc
SHA1 6972abf8af986b254d5b1b5b371f67816b98dd7a
SHA256 3b94cd41a73397934fe6badbe0c5dc15c48499e51d7764259af147d1f2533a8a
SHA512 edd9ab288a4de6ee7387a8938061d08cee8927918f4a5c17dc76589aa00521a24128f7ad5f7fd249ee80e1ed115539bb8e419dbb912e0c7a49592fa64b6b40e3

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 c848f6aa79e47ce6be40f3b0e1ccfb88
SHA1 7823a7377cba6f962c5e74b316dd7a4b89f05c7f
SHA256 4d23209bd384e70a0f804b11689358fc8e8ce8944c6685bc245d1a496d7fdc7a
SHA512 1988c0b6fa063bdcfae794a9d7b5e4e7de210c8d128b508e4ae32ccaa1e01409ca042fbab4364d778951d8d0e298f0e0553957db54daade5473f8617ac17dce1

memory/1648-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 03:39

Reported

2024-10-18 03:41

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"

Signatures

Renames multiple (4445) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\Services\verisign.bmp.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe

"C:\Users\Admin\AppData\Local\Temp\dc15e4cb42b7c82c9a2f5e37d990ee12e68e697da144e65fd8a4e113304064dbN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/5020-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 8a0e7962cc22b1eb8904d8be7bb9eae3
SHA1 ebba9c8531dabf45e44eebae08e5cd74e7087ee3
SHA256 62e8af158441bc5f09c14e091cdb8069f9ce273d60bc50d4b57121bbc61b5e83
SHA512 f8fef01fb8087c30e03d7fdbc1756c427df7a838cbc042caa1cf5c149fbbff2daa604046ae9c4c7b244694760e4b13c088879a9d8d38b8a5c23eb7ab84a41efa

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 4965a906fb034c7b172434cadfb649d1
SHA1 604e3914e237c2104dd578324172c7e19750768f
SHA256 158096cb54b0cb482b760e2503c7ec92f431a8d25d5df42677f95791c2b05e89
SHA512 4aa74ec57d580edee43c12a1f69a0166947e457195ee647d8b87f154224c4bcb5bfbd2692a43dfd0f5ede0c361bba7af7d20e3d6c912ad7c0d6adcbe82f41a90

memory/5020-664-0x0000000000400000-0x000000000040B000-memory.dmp