Malware Analysis Report

2025-01-22 20:17

Sample ID 241020-db7tqavcqg
Target df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21
SHA256 df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21

Threat Level: Likely malicious

The file df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3779) files with added filename extension

Renames multiple (5024) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 02:51

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 02:51

Reported

2024-10-20 02:53

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe"

Signatures

Renames multiple (3779) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\README.txt.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe

"C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe"

Network

N/A

Files

memory/2716-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 be93e4dd4f593af452204821665cf352
SHA1 e952e20a7e54660c5238cf4618344f93f82b2efd
SHA256 9a76f17d95564f26d81075c50a09e9d5f7ba2c0e03292b26f53600a2ee13fbcf
SHA512 572295b05c338508d914621fa316cb2c124f3fc93c783a9d78ba72b609b16eca2000903b025d31ec77336ddeafe4011a9e005198b0be3c20e590c07457c80e0d

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 ababc26ad2b897e2177c359fdab087be
SHA1 1fb77e7bfa448195c3508d6361c6124e0ad40560
SHA256 5dce474a6fd1af8cbb49ba58c46bc94eadddfcad61d198904b48505b6458390a
SHA512 67bbfecb2d6deffc5fa991f388aaaa022df3557cdb043dcd462d3cbdc283f0eebb3b5f0f1b36f696703200bca62959fe597e4f6fb2ec1f9fee706d8d960d560d

memory/2716-75-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 02:51

Reported

2024-10-20 02:53

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe"

Signatures

Renames multiple (5024) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe

"C:\Users\Admin\AppData\Local\Temp\df317e4cea52c5257ba2cf73877aaf12fa5c70786f7aa1bb617c3a552ac78f21.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini.tmp

MD5 b9195fdb5c10c482ed9b3e38d7d3e7df
SHA1 dc8212531df8e13fa5e7e9a33646ca1a0e8b9e67
SHA256 ea284c324dfcf40fc1d7139a2e834e35b91da5e5b66e8facb48968138563d721
SHA512 1453a550e2d8f6c0cc42f5bf388bcd6e1df3314349da924a956cf86d2ff71856f48d0204d3de55ba732aa261e74affcb6324830975c55f5f93ab6a591a455a00

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9322147a2799084f1ec23a655f8c9153
SHA1 cff3efb8d4645c9cf6c8a54587a9acfdc9d08842
SHA256 99b93ee82b2fbd32e8e0ba9743b7a95f70759af53b8f79943017cda311348dc9
SHA512 0a8e0768f419ecdf7b75b2b8c77c431dcd1c890f08b8be736ae94b452a0bfcc49d3f56488ec8890b4cec8b48cc26ae5717cde1d425f440239459330b86ea0e24

memory/556-709-0x0000000000400000-0x000000000040A000-memory.dmp