Malware Analysis Report

2025-01-03 08:31

Sample ID 240611-a3fyjaxcla
Target 92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7
SHA256 92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7

Threat Level: Likely malicious

The file 92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3798) files with added filename extension

Renames multiple (5272) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 00:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 00:44

Reported

2024-06-11 00:46

Platform

win7-20240508-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe"

Signatures

Renames multiple (3798) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\IACOM2.DLL.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe

"C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

MD5 394ac008fe6d64823fcb0ba5b61149eb
SHA1 719b5cc64fb65c14b18f35edd12cc187b3bb7445
SHA256 59fb54d6a6a42fba058143338da360dbe4b52949d01a408e8a8668a010b689fd
SHA512 174bcf48b73b58418d5be737cd1c125d781b353bc1ff27f6e2ee0692e9eadf73af4771b24a6d12d0755df68dec2b782c84a81395cb9ad290a11bb0e6a3f2c640

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 bdaca9c4c0c821278c039098884ddace
SHA1 55284e1f618ff95ec4a61d5752ceec32ed044f4a
SHA256 5ad5be53588c70ce356c817ccd630a971b0ba99d52031f22b854bc5c5161a5b7
SHA512 2f6b5bfc2232cf883ee2702173ef69d2e8dc4bd496414dafdc22684bd2286f5d0bc767c05f8a8dbd6202fc79db42350cc89491467b1f87fc6ccee51a27441f10

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 00:44

Reported

2024-06-11 00:46

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe"

Signatures

Renames multiple (5272) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWAD.TTF.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\CardViewIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe

"C:\Users\Admin\AppData\Local\Temp\92b952e2dc693d9d5e122dc8843a488d5180b69eb48d4526eec6edf4c11a80b7.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

MD5 adf017f7435ad533eb3bc5cbf4e6e2c7
SHA1 e9cb694bbbeb2c4fe7d3a420c1d1ab28b12107ba
SHA256 0ddb75d2984a5c263469cb9557332032c65fb489724d358448a3fcfdac96ce0e
SHA512 943f9e42569becee69d5c5a48106ad4bc680a6603fcfa40b1a1de9406eb67423ace6f28fcdc593aaca6ec163c9ad08ac1b34d486763c13b958c972f4e2a5a690

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 c9b078d08900729be3bb1eb35513ac55
SHA1 fa66015ffa78d992fe4f036c488c95ac823e01bc
SHA256 b8fdede284532395287f446497f7b95fe71ec6935245da72220f677a538ae8d9
SHA512 bc4c1ab9bd8d11fccf186427e6ec2555c8a73f8cc666f320fa67dd228d7be442fcc227a6c2d5b1a4b196a043163332f25bb9e409a4b74769023b62e56d88c171