Malware Analysis Report

2025-01-03 08:30

Sample ID 240611-d4dfkssfke
Target d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947
SHA256 d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947
Tags
ransomware upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947

Threat Level: Known bad

The file d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947 was found to be: Known bad.

Malicious Activity Summary

ransomware upx

UPX dump on OEP (original entry point)

Renames multiple (3502) files with added filename extension

UPX dump on OEP (original entry point)

Renames multiple (5240) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 03:33

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 03:33

Reported

2024-06-11 03:35

Platform

win7-20240215-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe"

Signatures

Renames multiple (3502) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\System\wab32.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\FindFormat.m3u.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe

"C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe"

Network

N/A

Files

memory/1372-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

MD5 ccad003893d93ba6aeca14da404aa3e9
SHA1 fe111a3d61f4411058d1b78e8fb65d1454279801
SHA256 be5c5dff1027650cea0b737cf8edca6366cb0bd5d5f63531851256935b4f666a
SHA512 a839b2fff674c7a06f96ce51e702819702f5a7a538ed85bcf21e2c592dfe3ec62061fce5ad559cec2f7aa1d396cf4ae65953e46bc84073102f1557c7c375c361

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 c9533dde19e7fa40e0affc4dd28dde18
SHA1 a0717414d96740c98e2e63d7c7e6bc77aa4fab14
SHA256 c30aa23f6e3db6ce7499ebded1c777a83e621a05a92dab8f6a26fdf8c94c0661
SHA512 33a715db4a3fb6121fd0df11355c30515b1d5e97f2d92a926d7047c0e86df0affd0790d75c15daf670e5a362164325c2bedd663c68a3467f62d4fd7c47af9989

memory/1372-652-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 03:33

Reported

2024-06-11 03:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe"

Signatures

Renames multiple (5240) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\ExportRepair.xml.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe

"C:\Users\Admin\AppData\Local\Temp\d1d196afe103a1e0a61b82be22d3366898624c8c24c198593f2dd55900e79947.exe"

Network

Country Destination Domain Proto
US 23.53.113.159:80 tcp

Files

memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

MD5 8bc1167a4c3ef2a81b8ffe9a11d7a637
SHA1 e0b981b228944b79ef47daf79767f814dcb16c7a
SHA256 4fd7a52e609a0ea486b0b8a2e632f20104cf28e467a60da918d0c2a088e7eb9d
SHA512 c1e26484492be5437d1150a79fc5b8136bd4f29bb77a74115254cac1ec0315f18946bb33047d750861ac09ea84ccb03a96cda2858ed9dd925fb1846f6b0c663b

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 09b2a0dbec017099401199e97bbe03cb
SHA1 4d56e7ceb65b2de543a6f7852cf2930df1fc0265
SHA256 3561acb5767fa804bd9358ac9ecfa9c752ef4d29915a74cadd7676eb48c73584
SHA512 c58c5c48b7db8e1dd2b9975312504f033b7315025462d4ba122f48143e10933b2322a37bae8af3dbf8855905777afb37247b1e30051173be47f051a344debac4

memory/1724-1972-0x0000000000400000-0x000000000040B000-memory.dmp