Malware Analysis Report

2025-01-22 20:15

Sample ID 241019-zagf2ayhpp
Target bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N
SHA256 bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107

Threat Level: Likely malicious

The file bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (4620) files with added filename extension

Renames multiple (3220) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-19 20:30

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-19 20:30

Reported

2024-10-19 20:32

Platform

win7-20241010-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe"

Signatures

Renames multiple (3220) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Mozilla Firefox\updater.exe.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Mozilla Firefox\pingsender.exe.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe

"C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe"

Network

N/A

Files

memory/1996-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 cdf2665b6f4a75cef91d5b51e9399b1e
SHA1 01021e9eecc44b06bca62afcd8240b3668d0599a
SHA256 f86b3930a9856fd4a1da5772ff1f6223d941cbddbf58124ac7d137f1f0ac7728
SHA512 54a5d32561fd38d8df9696e3d2313d7f646e755d2d42a3c730d1b834ffa596bad07db4e3f8cbef1dbfc801092e7c3f0c856216b9f6916629a5befe03ca4aafcd

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e2f1bc90f85f55eabcb79ea8f70ab8bb
SHA1 9bbfdd023b2234ed66f8c277ffc15b36ba13160e
SHA256 33f17b095333c17791e6ea70b151de7ef18ec83ed3ffa285b087a45be84a4f1e
SHA512 cad19002af80d9c588b9d513e2c50c702f65398593faa427a080c63795e51ac2422437b28c58b96844229678d9b3d5600a969bedf77e02877e72f2d22ecaab32

memory/1996-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-19 20:30

Reported

2024-10-19 20:32

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe"

Signatures

Renames multiple (4620) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe

"C:\Users\Admin\AppData\Local\Temp\bf41d5063e8f752a0fefdf2f4816603f353825b64f386a2dc4ef4ea2a872a107N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/2100-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

MD5 bd269b22b76d2cdf77ae6ede9d091938
SHA1 3dad7bda646e81f363af36299677eb006cfac302
SHA256 657d7978d52797ad963f9e90a3ea6a52a6bab33ea22a31083482256d5b6b4b0e
SHA512 f4d9b94676c7aac330490d1dc23601e148a6f5fa5bae564b9cbf32bfff06df021358634bddd83a50b5b08f42e456a2179826614ccbc15dd55374d80670e802b4

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 99695b114e2b6440193f587b5f2bd8a1
SHA1 4b915e2add27a6d1a13156d3f73848e91b71f87e
SHA256 9716b29ddb52db3f3d26469fbc29b3f693934c575640898ea387c8ed7a792b31
SHA512 d9a3fd33b546429c33d9d5a93710317e16eabd6fe6628a288c97116421c2170ec9145cb523dd4a2c82c5e1119d2791a4218ac42103d9cb38e0ded6d6e57b0b38

memory/2100-778-0x0000000000400000-0x000000000040B000-memory.dmp