Malware Analysis Report

2025-01-22 20:16

Sample ID 241020-avwn1szgnk
Target a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN
SHA256 a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaeb
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaeb

Threat Level: Likely malicious

The file a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4632) files with added filename extension

Renames multiple (3196) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 00:32

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 00:32

Reported

2024-10-20 00:34

Platform

win7-20240708-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe"

Signatures

Renames multiple (3196) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\UnblockConvertFrom.ico.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe

"C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe"

Network

N/A

Files

memory/2080-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 ac852a86c61ff8783a4419b031826768
SHA1 a49e5206516b6edad3956c8603707df8ae996ed3
SHA256 4f39904ae9a611e1d65aee456dd6ea1f4308f0f45daeef836f270187f35514f4
SHA512 50dc3e6ed7561b3322bf507654078b516fcbaa293ea2c9574c5fc292d7738aedd8e2908acc97b68dbe246f9a1a4321dcf0a98aa8edf18863b5d9537d57c1e4b2

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e23e6ff4630abcf2f4765e8511caf764
SHA1 01ceafbd8034a9f62bda658dbf00c2641a8da90c
SHA256 3cf87b0c5fe557679c661119366713206ba088cfb69f4364f16d57d3ee977077
SHA512 3892a1e2ef83a30e132aeeab89742c39e7d5eb2018d40708320af22d6af4c57e4279be1c4cac8347c04de049ab43f60256c196fb93e2f099791e9af902f157ec

memory/2080-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 00:32

Reported

2024-10-20 00:34

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe"

Signatures

Renames multiple (4632) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\BackupMerge.mpg.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe

"C:\Users\Admin\AppData\Local\Temp\a3fe6856d25ab1d1f5cf060383dfe08f7caa38182218ab5bb361b6c87b3fbaebN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/2676-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 bbfd9fdfb427e50e9b6004cf5b92aaf3
SHA1 252764b336f20d586e665388d62b1ca9fedc095d
SHA256 53fcdd5cb3fb70275cfd1bacce8c89a62e3a6e099e86b0ed996f64e1eda35795
SHA512 0e6568ec35a87a37bb582fa8b3af9a93e518a69a76621733fcc32135a30bbca7a18a9002a041e326e4e1c975d4e9fe2c0ea3e1d45d7b349e97a45f4e974593fb

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 a05938f8332eaf6e65a521087ba8aea6
SHA1 3e6dc9d25455f2b92220fafa2a868860964eef7f
SHA256 e9d8095d0426953bfd087141cabb6babe2f4987d43ec6534eebd1e85f9f3c3c6
SHA512 74d2a008b10154832ba9d506ce822a6fa555a346138e7334efcd4796fb2938b64aca2e09871e3ae674bcab0dcba9e51c23cb3d05bc4e77d98fdd01d1d0f0bc5c

memory/2676-788-0x0000000000400000-0x000000000040B000-memory.dmp