Malware Analysis Report

2025-01-22 19:54

Sample ID 241016-y9wvbsvdjm
Target 478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N
SHA256 478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0

Threat Level: Likely malicious

The file 478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4623) files with added filename extension

Renames multiple (3341) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 20:29

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 20:29

Reported

2024-10-16 20:31

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

113s

Command Line

"C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe"

Signatures

Renames multiple (4623) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrfrash.dat.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ms.pak.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe

"C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4880-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 590b7c8ccadfb137e67693224a132be2
SHA1 e2c352746ea2255fe56af3991fcf46ec2367eaa6
SHA256 460250f4f10be830713f2da991e2e76a4067f0bd89ff719dbf497fa83a664fda
SHA512 8c4f8e62c7dc6b0721893fca91ecea4c4f77d2374337a4ef1f506c328cf7eabdbf46a17e7fbb9fa3dd069786893db997eef3a3204db5743b08f7da4226be802e

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 a9d58070caa8348a6dd1ffbf217dcd79
SHA1 52f74ae87d028a5e4b51217a547dd9e0ca7c6d36
SHA256 b1f973cc264bb503f3a8858a9a43e4e3652bf02aeaf486e89828d82bf9bd245b
SHA512 2cc4e6f73e204ecfc2bca57f4298677d2e512e104e18f3e22c9db73d5062ae0c8ce0e56b8a81335c3c8be3ce906bbe86aab3480d33203145eeca349befcb9bf3

memory/4880-665-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 20:29

Reported

2024-10-16 20:31

Platform

win7-20240708-en

Max time kernel

120s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe"

Signatures

Renames multiple (3341) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Mozilla Firefox\postSigningData.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe

"C:\Users\Admin\AppData\Local\Temp\478e3cebc519ec8a0100331842a6200a8127408f2bf1a89689f076798d6e5bd0N.exe"

Network

N/A

Files

memory/2744-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

MD5 c994c73799b23f56e1ff3f02953e145e
SHA1 37d4bdfdf899251559555a194f62ba4c755a6ef3
SHA256 958fad711dd2ed9842804fd238be4737f2c905484f5e09e55934713673e53544
SHA512 9c3085353fa3a721b81119c44538a50dc1fdb7d33668cc318c9a1dea2582af6d6b3d3fe9e99cf384d8100212aa6c3c916c0532d9c09ec7e1f802bbb71fe2ba23

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 3cd0a5c935b6cb92df303c28fbe3d62f
SHA1 1e38992c38b61472ed58b25745d741a922830b45
SHA256 ef966cf86a74e7646ba76531f5e40fda4eeef0b5c454eeee024523cc5421039e
SHA512 94147024eb901d347616be81feffec210a3b03b79e884a9354a729ccbf900c8adf06bd50e4c0c77824f3eb5f6c432ca1cb19f2298abe6c7fc18f1dd9202cbb0a

memory/2744-70-0x0000000000400000-0x000000000040A000-memory.dmp