Malware Analysis Report

2025-01-22 20:15

Sample ID 241019-y85qvaxbrg
Target ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN
SHA256 ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8a
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8a

Threat Level: Likely malicious

The file ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (3249) files with added filename extension

Renames multiple (4612) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-19 20:28

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-19 20:28

Reported

2024-10-19 20:30

Platform

win7-20240708-en

Max time kernel

119s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe"

Signatures

Renames multiple (3249) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\bin\npt.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+3.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe

"C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe"

Network

N/A

Files

memory/2860-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 b0a7db3a2ea0a59e94b3945ed745ad5b
SHA1 093b0cdf9fb583d06393a3eb2dac0ed7c49216e6
SHA256 7ec75fe7d1d25db1cea75d4158e82e9a953dcb3f27f76275232e965d6ed2788d
SHA512 c97c3f3861f227f00c58620fc3eeb332acbea393b61fa3cb7598b1acb805c8a90556dc331662b5493a4927af70c5048ee22abaec38c40a217de13a57113d5721

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 6fac8eb7ef685fb10789547d5033200a
SHA1 cf20b0de5dec5ff89e85a61ab1c3b1d3fb1a865a
SHA256 f807b1e28a2978fb490411d98226c7c388949afa071a6c829e8bcee1e7d6fe1d
SHA512 25ac808ace75955bb40f79f8a6a84a9a7323109faec0c30e6b35f6a06fa4044040cac335518a761eab2baf4775f76c3640e1594ab19b1ac3fab1f93ee9e61aa7

memory/2860-71-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-19 20:28

Reported

2024-10-19 20:30

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe"

Signatures

Renames multiple (4612) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre-1.8\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\EnterExit.jpeg.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe

"C:\Users\Admin\AppData\Local\Temp\ec858a96b537665e928418b744eeab5642c852831a3428027b41fdb8a0786d8aN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 101.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/3832-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

MD5 e3c9decb79107d7dd30ed57e5aecfac0
SHA1 5db16dacc9de31d7797f5fd9f045a75bb431c3a0
SHA256 90c95adcc26431386f1b2cc7aac9e104070613f00ea436a40e6bddbd093f895c
SHA512 df3408b48921d7e06be7235b522c8af94c7d99ab13572becad70e47300b380af464265fa66b1727636aee85355ee7506d035a1af9515bd39b86de92869500696

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 839473f82c56269078ef09c21b94f4ca
SHA1 b33e2631495a711ab66ad136f5c250e3f595cf4e
SHA256 1e93a919b54b8aad5a5cdd83a4ed75932f80b25d46f9451651f8f5f5b0baedea
SHA512 3e811dbf95108b6c0b6230f6add328f2815eefdb06b63dc7c09e1331fc12466e1842606f9330ea33385a9cf9e4fbac479b01ff00c808cba3b561850e750338b2

memory/3832-707-0x0000000000400000-0x000000000040A000-memory.dmp