Malware Analysis Report

2024-11-16 10:55

Sample ID 240616-dl39aa1djn
Target d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab
SHA256 d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab

Threat Level: Likely malicious

The file d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3595) files with added filename extension

Renames multiple (5042) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-16 03:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 03:06

Reported

2024-06-16 03:09

Platform

win7-20240508-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe"

Signatures

Renames multiple (3595) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Mozilla Firefox\mozwer.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\WMPDMCCore.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\jce.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\bin\kinit.exe.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe

"C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

MD5 1d591fbca95dcefbcff2bff295ab9e68
SHA1 2cec390de2b7fef192ca4fc28ea366dde94e3b1a
SHA256 1d09c613aecfbd6f5f5d22d8ae9b4df0cccd058e640d6434a6062aa47b8626cb
SHA512 629e5455ccb5c92064965bd4aac211412e096de8912c51e15b0d9b0761429ca0c9c01618442b19ddd33383667e46955938c73ace8a4aa14e200ce0aadac1c3ab

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 897fd2fafda11f13e65d277eadc7083c
SHA1 675d24124f769baf78f2e434c0731e2797a2fa83
SHA256 9a9f684d9c37fa9f130e68926076b78f4d6b7d1cfc97bd6d0ea1330184cce785
SHA512 1b975b0079ef0492a298c2e6559e0ef314f2a0df0117fb198ae7d8ca7a30c504985b039d87594c987faceb1178e0c550b00ed8962b8961003b9bb8fc95606d8f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 03:06

Reported

2024-06-16 03:09

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe"

Signatures

Renames multiple (5042) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe

"C:\Users\Admin\AppData\Local\Temp\d53e80d3047628b2865b7dad67ffb0292eddc155c2a654e9d7d15e74478c7eab.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4296,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
BE 88.221.83.187:443 www.bing.com tcp
US 8.8.8.8:53 187.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

MD5 d8c586c7335f7ad4f7c925fa817de73c
SHA1 79315ce7c68c0a81b9e78c13b782231949c244d3
SHA256 13f6f44ff5aa2220b69fd096795b7396683490e4e53c34184da71a64ed4c317d
SHA512 ac960a3c086ff3aa045c3e0ba9f37f6a66583a3365166308e50d05899748932c5de9fccac762f11d19ca027b366cd6f37b97715f21b77fa9e0a08f131881ff44

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 03afb59f9900dafce981e667ffe676d9
SHA1 cea7e9f27b1a17df0afd083f2db154008a42e22c
SHA256 690688df2017c84a2fc5392e28087d64fe816c3b9c57038d449305b85670fa0d
SHA512 d849e95d4604f788565f2a9e45ec2d56ac81abc4c463c5ec7a3e5b62f86c49a2f7ddb1f5aeab405878b7535548f693ce21d3932ff0249c98fccdd2f7de795f41