Malware Analysis Report

2025-03-15 08:19

Sample ID 241020-zgqchs1brr
Target 323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e
SHA256 323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e

Threat Level: Likely malicious

The file 323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (5041) files with added filename extension

Renames multiple (3748) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 20:41

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 20:41

Reported

2024-10-20 20:44

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe"

Signatures

Renames multiple (3748) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe

"C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe"

Network

N/A

Files

memory/2008-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 3c801e8ef8d3d96538b0f94ed4de343c
SHA1 8608570df3159652f29ed27ea834eb2e5e5bd337
SHA256 2bd3ad8b18994937a63c6126564f66bc2169fbbdf557150b52d130beba054920
SHA512 092d0ec3f9c4aef8b1c64552b953067250535cd32487e8c406f7171352a7214f83f3be347a3d1b784e0d615fe8cca7b3410c9e733af77be3482fd64beb9202ee

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 52f602ee8172957139e50766d4f5db7b
SHA1 526b9e7ab0172ea4934dd649da721cef152807e1
SHA256 d117cc9e59110c03436bdc2085dc7ab1b9a5d8c4c3b0c4614805bf2eb044fcf0
SHA512 3026640cf9b1c4ad242328b8e760f4f78fac50015f31266aeb7714b34a554ebcb6bc4a3eb42ddb4b378c7e8f39b05c4a7a3d21271e1bfd3a69b9da9b7b8564e5

memory/2008-74-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 20:41

Reported

2024-10-20 20:44

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe"

Signatures

Renames multiple (5041) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe

"C:\Users\Admin\AppData\Local\Temp\323181a875fdab8120034da0bedaeef45397a4c0e7233e171b99ee030d6ba12e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/2912-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 859e3481723a7c2216790d1d6ceedca7
SHA1 9c4f16424a04ac0e956ceb761cc2686d99b07945
SHA256 da06bd437a10f11e41f2ec99368133df7a58613883fa4ef325d5846532f69b42
SHA512 88e47eb1f1d79cffa5be3616aec7f66abbde5baedda012c2176877e77a152af22d25ccf895cc7e714ef89dd9b8bee7669fa3c05a4132737f43e4400aa2054b37

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 015c4c9af5329e9400499de8da019c3c
SHA1 b7cb6005dfe9607fa014236d48ca001618254c8b
SHA256 ea5e12b37b0c4013c0389db237352cb30b6e83a5163b9029788b86b1fd81cd54
SHA512 e18a03f057500e72fd134e4fb559deb2fde28af95b865f6ba1781bb0e2cf8dedfe93fd4ceaa5b2ff85db7e49271e433eee574f8b26c5f25d49049b1f0544b318

memory/2912-672-0x0000000000400000-0x000000000040B000-memory.dmp