Malware Analysis Report

2025-01-22 20:15

Sample ID 241019-2qengstdrc
Target 78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0
SHA256 78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0

Threat Level: Likely malicious

The file 78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (717) files with added filename extension

Renames multiple (4939) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-19 22:46

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-19 22:46

Reported

2024-10-19 22:49

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe"

Signatures

Renames multiple (4939) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoBeta.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe

"C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

memory/4228-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 b91ca74bcf8be2a17cdd85f0493ceb80
SHA1 dec6d78ab0a538c1528db4a3cd72572f5f323fdb
SHA256 7634cdc338f63cf376b7c7972241ed6f124fe70ace069f708e6e7e2166267ca9
SHA512 bb8bb05b3bf6058ea04521536b78cd488051f415adc2f341d94ae212f5209aeaf56daf981309768442afbcc4a1d351f43d2424b95661d3b4b27cbf3f0a2da3eb

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 f3044a49c9eac0cd3f38b17824501af1
SHA1 012df7e60f918390c1dfb64d4f8e08a3c7e2b13a
SHA256 e7ef7204f4f89fc6b6596f26a869833be57981a565f7849c7a80548447691aaf
SHA512 5ed469d80f3374d051ddfa5141987359c918d9b80f12a079a8b2711313bdce1be774ed1d57ed3d1e160e1c40b74e4a5f2dd92110ed8a2e532740fd2971faa0f1

memory/4228-676-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-19 22:46

Reported

2024-10-19 22:49

Platform

win7-20241010-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe"

Signatures

Renames multiple (717) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\EditUnregister.ppt.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\directshowtap.ax.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\sonicsptransform.ax.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\AssertSet.lock.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Internet Explorer\F12.dll.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe

"C:\Users\Admin\AppData\Local\Temp\78bc3d8f055e9761720b8d104538e22dbf1b906f1a7d6556656ac55a6dd520a0.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 64898806374d3019e0ae817b22d0cbea
SHA1 d89d47dc72a6e505ea200c2202bb183311a2e8ab
SHA256 400646960e3058c5a5122877d521aee2e9ffdb5901c14498b49722c530245e1a
SHA512 a457481d667a8ca6a9923afff541a489873184df79f3c01259e5dd68bb0025967e8fa5c6fc6fb8e202c64111633bc1046dfb1e437b53c1ef8c1d578b39a5137d

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 f23d4adbf0fec1a5f99530a150ab722d
SHA1 e8d3a9881ac9a5558a13c57b007639ed1886659c
SHA256 5fe745238c8d3d5318924ff9623876cac13bc0c6399cc5cd88d50399d692efd9
SHA512 a6c01bbfeda1dd6340ed2e047f53603b8f949799698aae79d5418bd8295810e09994ccd4ecb8d0f37372af1272490077be7485a95d0a4090bc6b87c81557d2f1

memory/2356-0-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2356-26-0x0000000000400000-0x000000000040B000-memory.dmp