Malware Analysis Report

2025-03-15 08:20

Sample ID 241020-z1lhnszgqd
Target deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N
SHA256 deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8

Threat Level: Likely malicious

The file deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4663) files with added filename extension

Renames multiple (3452) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 21:11

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 21:11

Reported

2024-10-20 21:13

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe"

Signatures

Renames multiple (4663) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Crashpad\metadata.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe

"C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 104.246.116.51.in-addr.arpa udp

Files

memory/4604-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 937a4321c23d6be476e8a7af9968891b
SHA1 2649f2a86b24a264615a6e268f8d437a92f16569
SHA256 8d757ab795eb3e3b6a066e0c7788a900036cf25f7278ce04b0817e39aa47e6e7
SHA512 c5e053e04c870bfd75f32145fdf47a896b314ce802c2d77a1424b7c9c6c86f5a4da54a417aae1929f1515d93d28e1bb62b1713c7855f2e52a4b71776b934c53c

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 bb74f15006aa20edbefa7fa576500bb2
SHA1 9e31b77b4e33c622bb1545a731fc508f6833fcee
SHA256 f8ed81c48df09b685f61548f5ee359d85072ace59afe57e21f57805fab16069f
SHA512 a38a499af1cd76ddcf60900cda2e629f0d7c5dbc01909c0c70ff27b2ffea44f657035a15cb925f35b547b17d213994723ca92dd8999d80c4c3432261af64cd41

memory/4604-646-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 21:11

Reported

2024-10-20 21:13

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe"

Signatures

Renames multiple (3452) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\clock.css.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\UndoResume.htm.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe

"C:\Users\Admin\AppData\Local\Temp\deadfc5cc4c8454165697f0566ca8846be7803e785f2afb1fb10ff237e98afc8N.exe"

Network

N/A

Files

memory/1808-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

MD5 158c1c5932016354932a900c26a43e6e
SHA1 f6f99de5635dbf60d381e045b9fe5468ec30ad2b
SHA256 34a7b44bcd25b6d536f9797330dcca4eb4667ec462c87fdeb1880b8e8ddf85ed
SHA512 03c5f76b4324d39e50fc23cc036fadea5f349fb8d9bc30fc7de80b3e99c7dd7962d7b63a7ceaa4c6a2fb3fd213d39d0be321827d48f04bd494281bee22cfde6e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 fff20dbc9dcfbb21404e81c3634b527a
SHA1 07b795418f81fd25d454c4dae981e1aafe9c749f
SHA256 e3dbc6a53db540ed945f43634b03973de336c1d6f57e7716cca49d9cdf3af2f7
SHA512 aadf2950b5203f6ba202c6b5771c3dc7db070d7f2c74b9d7a073217765e78776075518ab190ffc0ee2f678c6d9590254dd8adcb5b4f80c88137967d1a6d0f879

memory/1808-70-0x0000000000400000-0x000000000040B000-memory.dmp