Malware Analysis Report

2025-01-22 19:33

Sample ID 241016-28eq7ssbkr
Target 5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN
SHA256 5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122d
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122d

Threat Level: Likely malicious

The file 5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4440) files with added filename extension

Renames multiple (2984) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 23:14

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 23:14

Reported

2024-10-16 23:16

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe"

Signatures

Renames multiple (4440) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe

"C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

memory/876-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 e46b5277fae83d3d6f5c59295bea023d
SHA1 f28a7a278f28e2da76e76976f61afa8af0b68f9d
SHA256 0b6c1a61d4aefba880de0f8fdc619df44af5fa4d658f7dba536cc8789b096cb2
SHA512 6f1664b8f3c76c5430332e3e434e325c60c9c55739c239b02c600e2ba59a23466065e025592a9fe63c3296efe08ac12b05d63edcf317ff013937be70575ff4c7

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 db4632f3d596ae09abce432fa5ae7605
SHA1 2c5776d86d5d5d503eb91cf673b701cc47e80a5c
SHA256 c2814d321d27aa49ecb5fbae32a63bed34dd682e1e606c9380d0c59e9352b3c6
SHA512 853eeb1e7ac119cae508d33b37899a9d822feb6ad0c9d05ffba5affdbcd2e29531cec72fd21722339dd77cb7acb33a215199c8816c02e4e5ff9948fee72c68d7

memory/876-784-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 23:14

Reported

2024-10-16 23:16

Platform

win7-20240903-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe"

Signatures

Renames multiple (2984) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\HST.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe

"C:\Users\Admin\AppData\Local\Temp\5c8a8745a02100b7c92201368463945e4d574e4a8567ff31aa0bec04ca7f122dN.exe"

Network

N/A

Files

memory/2380-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

MD5 177bcd59d5b367fb911f7825d841aeb2
SHA1 145e99452a717566da33d86ace1ee53962c1e838
SHA256 ad116b67a3f01720c2b809f9ef55aa7ed3816567c22effe2237a33192867c6ed
SHA512 38c8ff65afec0c9bc09b2a3b9262e826cbf1ee22a2e2753555b9578c83f4ef5dfa859dbaf53d7bfe2674cdd6d7c69d972e82817b0d8adf42b74871292cc860ad

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 010ec2d2c46f2ac7e82dd2a34865baed
SHA1 caa46e7131e96b0ff8f6570f89b3f66e45fd38c2
SHA256 1cd8f2b95f0a4d2969025f71ccffd6e6bbd7336fdaebee8a90d044f56af6a8e0
SHA512 e74ef40dc3d8da8b8a634a4bcb462a9ce9b92ef6692f545f93a7be1df46f5b8973e3c992f41a6a7524888104bb76974dec6fa982fe058b28b18f1e93c528d7de

memory/2380-70-0x0000000000400000-0x000000000040B000-memory.dmp