Malware Analysis Report

2025-03-15 08:22

Sample ID 241020-3nvglaxbmf
Target c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N
SHA256 c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43

Threat Level: Likely malicious

The file c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (5096) files with added filename extension

Renames multiple (3782) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 23:40

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 23:40

Reported

2024-10-20 23:42

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"

Signatures

Renames multiple (5096) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\BackupNew.avi.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe

"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/2648-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 4e5bdfa5bc2d95d8bfe39e8c6197289c
SHA1 56ffbf260eb53d546f3caa0b6268f3b067b88f06
SHA256 4b9282ec8e6c02c210954ef5caa1dff4789d111e0ab549c62ad5a9e83f410c80
SHA512 4b96544f151631d533e5f1929b4b4ba4355fa24bf0824a09b5c1197528e331af59cfe781d41f5b24ffcbdef72d50a5522dd7f25ee08d197934ade0a081a55263

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 36ce144a578a3e7863c5195e2d553995
SHA1 9206b18b568d86617f59db4ca6562030e63d3b5e
SHA256 faf8c1b5c559ee18716d738099bebff65a56fe4f8bd5f55ed07380b541502d18
SHA512 7ce4997e779caa725237f7d0e07d751e35885f4b0d997a2189e1e009328405833d0bdbc8eba31c35d4565e86d59474a56d9697eb6db13420e83f320eb251d0e6

memory/2648-789-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 23:40

Reported

2024-10-20 23:42

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"

Signatures

Renames multiple (3782) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvmem_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\mshwLatin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre7\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\MSCDM.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe

"C:\Users\Admin\AppData\Local\Temp\c687d0b4ab159a9f6350512288afa105b9e8ca37c1da5d20803c7069d2155a43N.exe"

Network

N/A

Files

memory/1832-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 26f7294c951f093b7541f0e55a4dc36f
SHA1 44e10123c2da2ef44c835e27ec9f641f22fc8cee
SHA256 81be2625801b806d42d01cac7ade1d399a978b08190942d12a3b481e63f493e7
SHA512 f7a24b82d466a49b920713f946911edae4fbcd8006c1fe1ec1ff302e8186f7812d32a65efb4f25c17e4237df94a0c0fee36329e0429ee0e4835ca4b5ea12aed0

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 52cafdba2cfdc95f05574344e2f44dbb
SHA1 4a083c006ec9f6ce6ba12f2a9c098990c9bb1190
SHA256 016957358bcd8737b5550246ac449973b5a55d860d9869befb20cc9e768bd075
SHA512 ba7810de5b8ced0e1e6ec2e896fe8901f1e2be17cfefc8a0eda0a43ff819f5bd7245f43348196e1b52e792a07e1e7a8bb9a865855e70d44b8477e7dc5e433a8b

memory/1832-70-0x0000000000400000-0x000000000040A000-memory.dmp