Malware Analysis Report

2025-01-03 08:35

Sample ID 240611-bhqgxaydqr
Target 9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8
SHA256 9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8

Threat Level: Likely malicious

The file 9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (580) files with added filename extension

Renames multiple (5105) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 01:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 01:08

Reported

2024-06-11 01:11

Platform

win7-20240221-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe"

Signatures

Renames multiple (580) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\OmdProject.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe

"C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

MD5 ea567232e80bfb85868852767992129d
SHA1 749faf5e7fac81bb086e8d93644c8f4beeb880e1
SHA256 0bbfc57b912fecbd8a4dcc77088daa63aaabde50904c6ea337507b45bb0b9bf8
SHA512 f3a81c3119f30d6c2370a15bb2dcc0ceef3085b275c4dac932c719ad15090da2fb63810646a9f149894ce7232adb301439853315f273db4c684e49e68d41b85e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 8e66c1585064db36f813d7799c94bbb2
SHA1 212c2603566282bb022efc26f19550064eea3813
SHA256 dfa1e9b28643980c18b2581142c0396c2382adaa1bebfd81eafcf9133bbc245c
SHA512 36fa39d9f843bb115a9606b9c9bad44f7714d3614cafbfccd94f19d7db0f43ea156997814d2c38a48025d229eeec5343a90cdded3a8f6288fb8a70e1199abfc8

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 01:08

Reported

2024-06-11 01:11

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe"

Signatures

Renames multiple (5105) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe

"C:\Users\Admin\AppData\Local\Temp\9d3c3dbabcae7102e7f88f3bffc9c57c396801e2bbbcbc90494c744a4f7c87a8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

MD5 49700e62986843ae473abce3c28f649d
SHA1 305a13866dbe60f2cd94ec94f7c23ae9d040bf66
SHA256 f7679362aa028fa1f0b168b286df25b85f4504453d900dd647a9c54d9fe52055
SHA512 830ce79c67eff6bf9230cf8304fe437a118efec358767ff3007a8f7baa08b6bd3825ea1bc0d07f1713028df22ac68777d616e2b31229c41598d00a41c2112778

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 ad10e2c0a2af13284e5070538ba80393
SHA1 a27c3142d3565231198b911f4d05ac9ed85f9c43
SHA256 af0539227685ea2b5d75ea7a13b35c929bdd9ca8384ef0c546c3831de15e9016
SHA512 94c6b9fed0a210f90c3ab82a3fa4db4b4e00da7302a52887cda7def8f6e6f23bb79df76b4918589ee8247ac6efdbe2a8bbdf6bac5b18c7a164a7495242b3c9b8