Malware Analysis Report

2025-08-11 01:51

Sample ID 241006-c7eblszhkn
Target d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940
SHA256 d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940

Threat Level: Likely malicious

The file d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3727) files with added filename extension

Renames multiple (5284) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 02:42

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 02:42

Reported

2024-10-06 02:45

Platform

win7-20240903-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"

Signatures

Renames multiple (3727) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Internet Explorer\iedvtool.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe

"C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"

Network

N/A

Files

memory/2080-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

MD5 0e85c7e5fdd564b818d86ec8b2b2cb54
SHA1 fbde6cf19b1e77ee4c7a3cc6f49778b8e8f1db4b
SHA256 04c596b813ebbcbd6284f0f34583302287e583d9615a8f94376cdc95a8d2175a
SHA512 ca7e3ef04be724611ac257872947e37f624ca62b7b096ca12a7a070f18c1f2e7df181427544a7daeb0757bb16cbe67ac38957d9967c94570db17de734da9c795

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 3adfefac3c3e06207cc9e0365c6497d0
SHA1 d6102e7948d47407337677321146abdaf83b7ba1
SHA256 20a381dc0898f237481f59c7147402ea4946bb519ca046a24f8510b159c6674e
SHA512 b4fe2412881e7a2279062876491ec86799330547496b70a457a21389a6684428e34f16ec31180618ef341b0e37b6e53145f35118137937c1e95b75227f1fb59a

memory/2080-70-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 02:42

Reported

2024-10-06 02:45

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"

Signatures

Renames multiple (5284) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSBI.TTF.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe

"C:\Users\Admin\AppData\Local\Temp\d099f259aa6d20d54fbffd4c41b5144b8dc01a535166185e49e352cb97441940.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/4896-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

MD5 386f6d0cd369730e248e43845da137c5
SHA1 eeddd6a7536ebb70666995175e61ad7d6345a3a0
SHA256 c701dcd9e43a984120b07a1aaad950795dee5681f3d7fe969ee4ee29f2caead8
SHA512 8bf2c56b2b90260d4dd3f209846fc3a03b8519eecdb2ce8f6334da8dafe494f11965f92c0390131884fb88185fcfa3a897d58ebb29bfe5ea8340febdb6f1ead9

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 828fa1f59994f7075b8868715c311b80
SHA1 05d9702ce20cf38db8732a0a5a561176d282f80b
SHA256 98dc4d6289202e825090a75e897814731422dac40b52f6dbccd45460c8185259
SHA512 3e1962aa6d356b4e60e8f25890b2d872e4072507871d771a5f9f01deec1a352d7fdb5a41170f4491742b206537950b825befb09278e0eb9323ea802071aa8d05

memory/4896-1008-0x0000000000400000-0x000000000040A000-memory.dmp