Malware Analysis Report

2024-12-07 10:04

Sample ID 241114-aj7xxavpcq
Target 7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe
SHA256 7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21

Threat Level: Likely malicious

The file 7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (2825) files with added filename extension

Renames multiple (4111) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 00:15

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 00:15

Reported

2024-11-14 00:17

Platform

win7-20240903-en

Max time kernel

119s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe"

Signatures

Renames multiple (2825) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Internet Explorer\Timeline.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\bin\java.exe.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\ConvertFromDisconnect.mpg.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Mozilla Firefox\install.log.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe

"C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe"

Network

N/A

Files

memory/2840-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

MD5 8cd22c0ef536db0312d011b71663ee5a
SHA1 8c97dee4ee533da6b9e3e6db876a9c9ec5280283
SHA256 252feca4d67b94f4b8792cd022201f913077fe0ea9c0db6a9223e57a746b0233
SHA512 d1cd001590b6f968f76fabfa918061a182112583fc9b31c23eca2383707ff85c5fbcb6457b426776727ba61dc3b3498671e9390cf23f05f744ecf776c84963fd

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 f90c8c7d1a6b74a55821ab4460d0a1ae
SHA1 a428a085b3cef158d88a4bd8bbe87274ff0f7419
SHA256 6700327e0ecab8b796c5ba5171b5192da3d27d962ccf66e5d2a0317a413a9643
SHA512 c85815bd522e3f3f2c42f69e70d5aea530b78f5823295bb7bcd14cccb012b8f6dd8605f55e6bcac37effda62148ad43d453f69e7958620ec2d295060bf7ac328

memory/2840-68-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 00:15

Reported

2024-11-14 00:17

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

93s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe"

Signatures

Renames multiple (4111) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\AssertDeny.easmx.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe

"C:\Users\Admin\AppData\Local\Temp\7721ec026bef9dcf6f19771ce13fbed80a97a563ac1c1564db43f444b0ffff21N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/220-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 5258fbc22f769604a9d0590b1c0df96b
SHA1 bfc7aed2ed97a4bfa87ac1eb160678fd516af0a3
SHA256 98a21435268b371baa9afcab9810b23333e8b9d0bb410e2dd424e62e64f24759
SHA512 52a755a7c5664070a7ed84e5aaa836e4f16f607fc2daf2bd66595af72e5200a2f1bd269434d3ca4cc923035c2cbfcfa3ed9de012d049cc956399335bf98908db

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 100327b458b0890449137a450e951f57
SHA1 291dbe2dcc7a666f1ad603b02dc960380d7f7774
SHA256 47e592ee9f904f6a58a1c19aa5e30271eb802f1e5a364c1ff7ff2dba76eeb46d
SHA512 12a3aa72ff159d566c15c5de534a09fd0b3a1285d9b3ae5acccae21af600dd95d661341b2eca5b9ef6b4c06adfdc4cfb53927279abcf1c876e18183140dbccac

memory/220-650-0x0000000000400000-0x000000000040B000-memory.dmp