Malware Analysis Report

2025-01-03 08:31

Sample ID 240610-3htccavemd
Target 7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813
SHA256 7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813

Threat Level: Likely malicious

The file 7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3444) files with added filename extension

Renames multiple (5026) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:31

Reported

2024-06-10 23:33

Platform

win7-20240419-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe"

Signatures

Renames multiple (3444) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\currency.css.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\weather.css.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\init.js.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\Journal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Defender\MpRTP.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe

"C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

MD5 080cb5ed761810f083ea71e0cb020bfd
SHA1 3eda532fe1c4b4ad7d24abd66691c58bb79e7ab9
SHA256 d491668e0eddd22ed2b12469a9538d5da73b1698f65292655c50cce529b63276
SHA512 88d8063442a3f3b75c2a5e3ed71b0a7404cb775f3f5e67014b54a6e87b03d21d9ddb5e42f3473e9cd526ebc4f84f9f19b58ce868f9c1cb85be1d3e474f04d821

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 806338074419fdaa1462863cdfb904c9
SHA1 e54aabcbf0477deb2adff5626c3330aeed1fe516
SHA256 2859d55fb8a7e2b628c2e096fd6692dd1f4bc95cff42ec1a9136369863e5530a
SHA512 498f9aa3e27572e503ccfdf7e72ae0f24eeb5a9feaccd8d77df1bf5f613ca5bccceea497197d9da120b4e6b02c7275ef17316afe874f076b24dea833aad17739

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:31

Reported

2024-06-10 23:33

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe"

Signatures

Renames multiple (5026) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.CodeDom.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe

"C:\Users\Admin\AppData\Local\Temp\7508f15d6df21966effb3201d7b378b71a4c3b1e4bd3bee082e0977fb876e813.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 56.110.63.41.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

MD5 fb123d6f32bc2f45a918a40a9514ff69
SHA1 e108b015e6ddd9eeaa18769c670be24ee2789f2a
SHA256 67e174b2e5eea87effc30b6f97f4d0b0bbea63baebc75a6ce46517d47a01ec71
SHA512 8be4b270f469b796925693176302b217ee250c772eac7789cab590c1da01d2b371e3cf86a6576044907ae5fd1d008f2ab87943fef9304224dd17e98d38b88215

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 19559f830636034a515185d9afe20cff
SHA1 353006caf5c442ebe9cca7c24cf229eaef7ba05d
SHA256 4ce7405f9cf0462d900bc2aefdf4b3dc1e7ab4092904547f10d0df9fce76a6ce
SHA512 010e8281028e0ccefaa4cd83fbc978b73696762fc30162eef0c98dfe8796d78bfb4109b5a28b524e82a892f0105ab6d5989bb6a762fa86037a663158c7f0459c