Malware Analysis Report

2025-01-03 08:32

Sample ID 240610-3a8gasvfrp
Target 709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2
SHA256 709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2

Threat Level: Likely malicious

The file 709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3678) files with added filename extension

Renames multiple (5168) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:19

Reported

2024-06-10 23:22

Platform

win7-20240220-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe"

Signatures

Renames multiple (3678) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\DVD Maker\PipeTran.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe

"C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

MD5 d3991e6dd14b0a95f667c574b43b25ab
SHA1 49e1a6dbc898e67ed8d8eaeca70925eea78b7001
SHA256 1ac82d7f13f5296b81d3d015eb8011d700461cb25738f1eaa9addfa5e3bc88ec
SHA512 2ab7398984ef5ad01292e8687587e8f8f41da080cc1d8d852b68227b0fca1a745e2335ce07501bfd0a289de02c30bff1d273657db8d3f9d9dfe19089b77ec850

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 616bf02200e0d01353edcdc2e35f0593
SHA1 a6767426fb6ac7583b83438bcc146e9e2a26f221
SHA256 39c59804a4ebd67524dc7ea2233d039db6649ee0aae72d0a64649037a09315dd
SHA512 5fa3f22f99c5e01e3bf82f975eaa5f50aad79428500beec12be1ce3c4779cdd9c75479a72d370e6118045948aad8a87ac8992bad148809d572be2ac396e88610

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:19

Reported

2024-06-10 23:22

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe"

Signatures

Renames multiple (5168) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_wer.dll.tmp C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe

"C:\Users\Admin\AppData\Local\Temp\709cbcb5256d38c04f08482d540b55a7d471759fce97b6a1d2996712a103d4a2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

MD5 aba7943b74176484d4499cf684ff1bf2
SHA1 f1ad5a7f56e700642906cfcba510c0c1278137be
SHA256 4e80273c17e0ee245f7bdc3c24965cee4986eab8b4334aa8368d9e3482e07a05
SHA512 ed7b7081ba4bd00128954ad5e974c9b77a4a6569347fbea1991820c186e29d98745277acaf03a0bde1a2f627b54b35d5cb318cb39ff6018175c87f7fa11e829f

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 c35b2c16069f41a960030f5aa902b34b
SHA1 a8815651a0263624d3d35a634e7cd56d74423653
SHA256 300c6674394b5b4c01338a1bd44ddef1aa21f218869ff46f5a3fea03c2516edc
SHA512 5a8d3443c2743005dbad521d209a37d801991bb5c8f04bae19009a55258b8a7636453762678362df3675e6168e3f06847cec693025caf5d0d70ee1926f82157a