Malware Analysis Report

2025-08-05 21:56

Sample ID 241006-lm928a1fph
Target d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN
SHA256 d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fc
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fc

Threat Level: Likely malicious

The file d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3738) files with added filename extension

Renames multiple (5188) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 09:40

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 09:40

Reported

2024-10-06 09:42

Platform

win7-20240903-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"

Signatures

Renames multiple (3738) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Media Player\wmpenc.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_s.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Journal\Journal.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\bin\eula.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe

"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"

Network

N/A

Files

memory/1932-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 ca31de6a5029e1146578e26c8b02bf7c
SHA1 a1e4dd961bbb756ff8c2d4523f7417be6ea29ea1
SHA256 f1459eca6b666046c3f28b2c5ba035f022e1208052a673bbc61bfaebf443626a
SHA512 6f71e147685227bd94cf7bb8359744d4e7297bb48f5552416fe168799385c4f5e59ef482d77576172477533dab3958bd6862c4386c30b8d2c52efbfd431d7d5e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 83f4d0a355b45ec095d186c257c404e7
SHA1 ce201f3ab48b6566888178cb1ede148ee953c4b1
SHA256 49bf98be6d75e15db9966387271390a19d52fb1d9fe04998af1da55468c82902
SHA512 10c8170cd6830fc21f392644b9cec8dd1bb3cb393610b3028ca3e1674f7138d438f5237d88df0e3c58fe4b5e60d04ae315bfb312e399c6aabdc902fe37b30f4b

memory/1932-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 09:40

Reported

2024-10-06 09:42

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"

Signatures

Renames multiple (5188) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe

"C:\Users\Admin\AppData\Local\Temp\d965f9ea60f6cd22c601eb3705bb89896f327b93228950607e0cdcf2fd9ec9fcN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/2488-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

MD5 3986fbfc538ad021c926879a95f94374
SHA1 b1da70c3aab3568b231c1678c83ef3f8659f16b9
SHA256 cbc8345467717f31db83cba00856ee6c13c538ff9ff653060c920fa0d9809916
SHA512 57f104ad84e048519bdf510aaf684a25c8670d58bc291c86faff425b6287c48371f4a72460e12660cbbc3a5208bcc58cfeed4f34c22cf07ee4b000a23a7e7565

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 22dbb0b049f8e45a9a530fe77ef90037
SHA1 4f68d1ec7f5adc230e2e23bae8950d56fecf4540
SHA256 91bcb351c30e077a7450232aa5f9651c37f685bbb70b7b421297ed4a9299eece
SHA512 8133838a25a1a4b63cc3d3a12f04518fd68fadab7f05d91dfd49e03bdd54f2c249f34987f494f6f868eb25b8dc605094a5d12677b5c5efbad3c860ccc7497ad9

memory/2488-981-0x0000000000400000-0x000000000040B000-memory.dmp