Malware Analysis Report

2025-03-15 08:22

Sample ID 241020-1afp6ssgqn
Target 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106
SHA256 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106

Threat Level: Likely malicious

The file 45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (4121) files with added filename extension

Renames multiple (5203) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 21:26

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 21:26

Reported

2024-10-20 21:29

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"

Signatures

Renames multiple (4121) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\PREVIEW.GIF.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Media Player\wmpnssci.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CACH.LEX.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe

"C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"

Network

N/A

Files

memory/2748-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 62b0e959897558e6df2f1d03401bb2f4
SHA1 afaa3bb6a9ab04a33c67012da6ef1409f606d64b
SHA256 33d17ea8926c8246612fa9a7c054036ca09726c3061c35557b10da15a8c4b95f
SHA512 b40fd25ae71d2eb96937183988910eb4280d0feee4585b6cf3271f4176a5d112b06e6d889d968506b7de0c7d9ab3b58137d13d572d4ee008ca55c1ddb046a16e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 ffe181ea77bae4b94ecf805c08fb780d
SHA1 3645c1d984235e59059637c63f4af92e4310c478
SHA256 f96805f23ceb4a09edc612c939f6ad33a49c1fd789f371cf112e100ca1acb0cb
SHA512 698d7ddfbd9dc660d0b706601f65a90fd8232b9b0d6b36e31c4f0d05b68187365718594440878eda39bc65fad9c5204f84e815628d67d5f354cbee89d3c81c6e

memory/2748-69-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 21:26

Reported

2024-10-20 21:29

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"

Signatures

Renames multiple (5203) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.tmp C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe

"C:\Users\Admin\AppData\Local\Temp\45a78ea81ce9c06148c7f576b3ea0103fc5f51b20c4b656a322c83c6d2cf4106.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4052-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 342b85758a1a03d4648ebf9e8cf2c983
SHA1 ab02011b29b20e2bb1c5cb6d3dd2648860ef83bb
SHA256 137d3e7789076a743d6f0e246399abef8351535df83dc5cccce4fc5ca2197660
SHA512 8cd5f79a12e4143dda8af1c74629f08dc4fad0ab9e523ef255b423bda0460bd6c5e98d3ab7037154c8d01b82fdd87c64cfb90130cbc4b8fc8fcf7ae0c189da98

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 1641d52cf612de3e9503ba4b2b33768c
SHA1 70e0a73e10c8d5b453455abfe3e85ec90a11e5d2
SHA256 befd2e4e4baace9d4d592575224b2006ee9b5b6ee8b7523baa868c453cc9e3cc
SHA512 fac3cc6aa552d607bd55d88914a8c0f89171c0ef98518408ceb4636a40f54d19bc66d8d727430025c46ca0de0ef52a4839b1e478e2ec1f005b7e2c8f41d469f8

memory/4052-667-0x0000000000400000-0x000000000040A000-memory.dmp