Malware Analysis Report

2025-01-22 19:54

Sample ID 241016-ztc8qasela
Target 571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451
SHA256 571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451

Threat Level: Likely malicious

The file 571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (5035) files with added filename extension

Renames multiple (3796) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 21:00

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 21:00

Reported

2024-10-16 21:02

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe"

Signatures

Renames multiple (5035) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoBeta.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe

"C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/932-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 ca8b41f4c3555714b5aab4c678d8c7ab
SHA1 51fe59ccac28db3c2b9e51f7bd2377dc50a34968
SHA256 9a39e9f91f04db49d28601bfb2c1d53d2692c4c435937259c4f098dbbcedb3f9
SHA512 65154193fe46a6351bcf7a598a47e19a828e8fbf39a61ad5b045e1c7f73df9989ecf24ac2caa64bfbaca5a4d583fda3302e64ec212980d6b467a28900e1869eb

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 a808278c81f9acbdc2208eae6772fa8c
SHA1 98fbe04f71a5b8e310bf14b6c7f6e8c2cd5f2d88
SHA256 199b03688175cdd0728cf7bc929b384ae0f7f1a7e3118a4a33585fd0a3d7ffd3
SHA512 07884e9464663a5eb9448ea59f004cc339accc54c3c395dda6f5f6dbc0e2321c7d581df5da64fd129ed6ee63bd63caaba597b27d4aefb3ad0474e649a4f9c515

memory/932-768-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 21:00

Reported

2024-10-16 21:02

Platform

win7-20240903-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe"

Signatures

Renames multiple (3796) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\WMPDMC.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\localizedStrings.js.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Iqaluit.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe

"C:\Users\Admin\AppData\Local\Temp\571c7ece5713f462697d32090c4c987cb168832d724c2ef905e5c6d5a81e7451.exe"

Network

N/A

Files

memory/3052-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 1c6fcb7f16e5c9a7a557763a5c113174
SHA1 ffcfe09764382c60b4b857bb28d401d0fb180a13
SHA256 aeeb06fef49fbb654420ecc4c4e93cb2fab255983095f6a8cec49cbd9efb7002
SHA512 dd1050605d43382184eaec034e58551f8807766205eaf2632ab486f22477d223e0ebfd606adbf0e277b744b23b670835235709b421949b3969444db6ed97f95a

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 921e61fcb8e4e09d517207a8779ad491
SHA1 181ca2241805190a0263d9e5f431e5dd6e59a55e
SHA256 8b476da0b78d532ede3eecb60087d56f4e402a747f231ae6a07f1a1ad9205472
SHA512 dd3265942e1fe007ac606186b175d6904490651b614d3c5b0cd7797d78c4a02a166ca991dc1cc2a00bab605174b245d752d6a3125f4e08e396a25644b1a7dc84

memory/3052-70-0x0000000000400000-0x000000000040B000-memory.dmp