Malware Analysis Report

2024-12-07 10:20

Sample ID 241113-c32aksyjgp
Target c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719
SHA256 c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719

Threat Level: Likely malicious

The file c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (5195) files with added filename extension

Renames multiple (3782) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-13 02:36

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-13 02:36

Reported

2024-11-13 02:39

Platform

win7-20240903-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe"

Signatures

Renames multiple (3782) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\RegisterRead.emf.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\GetInvoke.mp4v.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe

"C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe"

Network

N/A

Files

memory/1048-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 1feadab410d62a560c3c16437a96e345
SHA1 595804e6012a08b68147829d08ecde769f45aa5b
SHA256 ef6c0cba2e598c879c179423981960ebdcf9271a421964ef8e2bba6b538af19b
SHA512 bd8a460255e95f6b4889e13bd1e3ef448dda0970a048c2b7bb13fc75e589592e1ee7156d1e795165e9440e6a8237f9029e9a903f18f9cc961aec2224e2031baa

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 18dc1bc88ef1ba696cab5abe23732461
SHA1 fc734ef5dfe713062e230cc95a37020978554223
SHA256 ba27ffe11e6606643fc99fd1bd0d98abb9dd32ebde7d80d73d8e78cb69b9b715
SHA512 2d338fe28b2519d8cda4cc5833b86c0645c395a174ae5cbce8cade71bd68506d3e82711db51ad285812e2e08714fcb9ba6c850afb14bcdedbf934c101a40a83b

memory/1048-75-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-13 02:36

Reported

2024-11-13 02:39

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe"

Signatures

Renames multiple (5195) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\Word 2010 look.dotx.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.tmp C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe

"C:\Users\Admin\AppData\Local\Temp\c5816817cf4b51a48c47589b8a5f15eaaa8a0c36ead6601f81b260a416902719.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/2032-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 270c84daf211a87dc5eba5b2f05357cd
SHA1 ed4296db42e95771c71502becb27a08621112b4a
SHA256 f999c06102eab20e97e676f5e133eaa021694d94328e185b5c482a14427b139d
SHA512 861cba06e42b69b537b6d3a4a8b1a5b7f1013bb75f439f46a96c4c2b727e9c8a7237e1fdc4007a4a99e38f5e34d9f6e56cd7b08bf8fb5a8ed2e6b05052fa0117

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 adf00e0582626e0bdfa18343438ecdf3
SHA1 192958b2936d3743348e44937f7076f23c84a2ce
SHA256 2424e568edbfa5ad4bb7e3615e7c1820e994ba15688808c5b7b9e9e2c762d74b
SHA512 c5e504c04861629992f2fd9632c8aaba2b96275c714b5c4d6507da67b02a5a39e72f2b94b9c277685637b5d331ba8e4db056f48d599e31a36d62b9f8a5a9466a

memory/2032-739-0x0000000000400000-0x000000000040A000-memory.dmp