Malware Analysis Report

2024-09-23 04:44

Sample ID 240614-bt91patdlk
Target 92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969
SHA256 92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969

Threat Level: Likely malicious

The file 92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3635) files with added filename extension

Renames multiple (5186) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 01:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 01:27

Reported

2024-06-14 01:29

Platform

win7-20240508-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe"

Signatures

Renames multiple (3635) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\logging.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Mozilla Firefox\precomplete.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\skin.catalog.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe

"C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

MD5 6a6925beb6c20b8ef4550c29520fe48d
SHA1 bbebeea83fc2b80739894d983cdd92258606abc2
SHA256 672e3bd497f8fc5d3e3b0f100e596d302fd9c94b0dc8c332c483a352be16b1c9
SHA512 b15893ca4fa35d26b5915d6193a9e35a9a6891061d4fcbc81ba5e17cf4cadf267ec716dda1d8cdb732fcd9b39f66374a3a5aa30b90365b75a1e138dca2f06aa9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 680f81e7bad91133ff75891ac42e5bc9
SHA1 8de0aa7fbde30f75d6f359d9a71329ccfecf5dd0
SHA256 86d69d5acdf5d341c4916cabc4d68e0ac0ba72ff3a40dc22263cd33ceefecc2e
SHA512 8679424c70c6bef3629ee4d088c117ca0c071b8569a0135e48a5319c75dd4bbd2e1cbeb04ac4eea866e188db756babed42757eecbb0ceef5dbf0f984f07a5127

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 01:27

Reported

2024-06-14 01:29

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe"

Signatures

Renames multiple (5186) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe

"C:\Users\Admin\AppData\Local\Temp\92a03bd3d22f47f0cb14bde25cf71144cecc040ec9b2233c3f07cddfb30fe969.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

MD5 fb928fadbb949c9489a0e51c3f194341
SHA1 0bce9ed01b4c55c9a1080d5569037855edafccd1
SHA256 ebc5c69dbecc43d57fd5741711ed89f1ef05c82d9f4653b8a9b617a9c690280e
SHA512 42fbb3f5dd326267438c3120413c12b0bd3ac4cd99367b4513b3394db5e0aac88e44ea5178b95d94bfea0394474474186d0ee986fd56334a802e79375013c04c

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 be19514228bb615a6514be4af2cfdaeb
SHA1 9465c4bf390fd7f748339be10f8813685383f78b
SHA256 b7fee7d126e88661445fb88e7db5feca52384fec345a2e301a24927ba6e0f696
SHA512 722ba836d9c82819198e54308c35e2054f527a723ad5df8940cdfe0935a919c19f9a5d21714bec651c543eca51b9ded11531034a19535dec25086eb5526ded7b