Malware Analysis Report

2025-01-22 19:54

Sample ID 241016-zvq6zasfjc
Target 5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N
SHA256 5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6

Threat Level: Likely malicious

The file 5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (3260) files with added filename extension

Renames multiple (4618) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 21:02

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 21:02

Reported

2024-10-16 21:04

Platform

win7-20240903-en

Max time kernel

119s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe"

Signatures

Renames multiple (3260) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Internet Explorer\F12Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Mozilla Firefox\firefox.cfg.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\EET.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe

"C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe"

Network

N/A

Files

memory/268-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 c5b6eb31c8451a3092305e8bdb202e71
SHA1 70ba85e31587bcc9d209f075d9d1214c05764406
SHA256 d62be706120cce72a88ea8e0c883395549f7af7d95e207bfe7b8800536bfdcc9
SHA512 7c689858d15ee238fe6390af31d4f0e098cb7eb4ace07e845c1fee7529faa12ae3efc73f49e57417c0c396d85e6b8bf1f9a134afaa4121651c0de712485872bb

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 2a10768c9f71e273549a003864a118c7
SHA1 e8673971d57bd041e495d6a061bc6f0c855e9155
SHA256 a27131e9a5de98aa7547911a9179d359b84132591ed1b1f9aaea77c917230c06
SHA512 52e839d3af6dd651bbd664d8e91ac8c0590cc3e4a34a7e69b2bb6cc7a007b756ce1da2ad58bdfbcf19952dbde3f53dfa0dda4fc3808d340880bbc6acdb3dac5a

memory/268-74-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 21:02

Reported

2024-10-16 21:04

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe"

Signatures

Renames multiple (4618) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwritash.dat.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe

"C:\Users\Admin\AppData\Local\Temp\5f6952416fae03676bcc8dd95caf181c8f6b132d31249635c2a842691cd908d6N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/3704-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

MD5 4caaeaa2172cfaf729e4dfc301f629d2
SHA1 3c58118f94555665d9b12ea350b68c9d31d1f2ec
SHA256 e16c82224b80087307ed9c23deb93ca1bfc3c4c903093cac14bb1cf1dbfdf28b
SHA512 d66cc62240053eeb33324a2d440475fbc8f7ffc07bd23b0bc6651c9e36ee7c8898e38ee1753d85f55ca44d8c952d1f315b93b75daa2c9ba9bd696398979713cb

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 d6e3d32066d93c2b5197961187df3682
SHA1 7494ff8867bc1a14b190ab89a9b984e961ce5486
SHA256 c0ad2c568f9617e68fd76729198478d8808c535f46445cd0dcd5f09847c83875
SHA512 3dbfedcce3b9fa085a52fa53c251072787511555e51484796035ea6959e46bb690acd97da667dd08b01e9e80459fb15219e7714031c66d60e17e4e0ec04b0ffc

memory/3704-780-0x0000000000400000-0x000000000040B000-memory.dmp