Malware Analysis Report

2025-08-11 01:47

Sample ID 241005-x35yzsveje
Target c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N
SHA256 c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347

Threat Level: Likely malicious

The file c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (475) files with added filename extension

Renames multiple (4646) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:23

Reported

2024-10-05 19:25

Platform

win7-20240903-en

Max time kernel

119s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"

Signatures

Renames multiple (475) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\OmdBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe

"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

MD5 c724833703e1fb8a53fb1dd6f8564d14
SHA1 73c8c1674843bd720ffbc8c19992c160313fb849
SHA256 c861230fbd1f55b5b1f43cfa9b00a915c1a3ce638382155a7946f50f3539053a
SHA512 462994d1ab3138142669bdc97f4d3881db5828495d251e2dc6a9025936e7f53e0cd2b2a8147e434a0f8854d625264c897cb79a63304c57f9854313ca3d63ed4c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 08dae61060371478db2ecc52e894a17a
SHA1 f036c019b5f47affd66fade01b7e8fc4997f3110
SHA256 19b29f66b577c305f4c8bab22a8c1200365f524676eb8c3cf5c59a3092007d89
SHA512 216c55471b7cf5c8489526b0a361285aa729124697c7f48d5d8ffd64355ebf1a367225b9a6d30adae3616746781f113676a1f30a16b26fcfb063fccec063867e

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:23

Reported

2024-10-05 19:25

Platform

win10v2004-20240802-en

Max time kernel

119s

Max time network

92s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"

Signatures

Renames multiple (4646) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\dotnet.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe

"C:\Users\Admin\AppData\Local\Temp\c19dc69f34f93e0591399ec8951653a6f0e5ed114dfc87ce530de1734d689347N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 28.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

MD5 7aa7c6facbdd4b51c1a53b21435ee0bd
SHA1 14b165bf42fe5a3d92a50b152d8f3699a8b037b0
SHA256 1659372521b2d265cedd6dcc53fd84c2336fa272ec7c8b2b43e697468752100e
SHA512 a28ad04b1cb0a55849628fc85f4dc8ab8e150da87f2ca43da280cbdd7ab868827bbabcd0e74c83f6cca2815dc88eec7b89c4080b30b25d4e012281be70ae67d1

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 36b9851fc0bc5f8e47a283e42782a655
SHA1 44376db8dabbcd6228d6d476d47eb6844d6cda45
SHA256 d215be153db29f328ca3726ea1ff249d717cc17cf2a4639eaeb79a54ba29253f
SHA512 15a98251242e256800a982fbd9cdd8c4e3e2f2703ee42f5f55ca3154d3069564717c1cf85cf084f120c4d2894107ab01745cc159740603a90e6d1f1adcbbf5b1