Malware Analysis Report

2025-08-11 01:47

Sample ID 241005-yaplzavgja
Target 0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N
SHA256 0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497

Threat Level: Likely malicious

The file 0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4671) files with added filename extension

Renames multiple (3435) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:35

Reported

2024-10-05 19:37

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe"

Signatures

Renames multiple (3435) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe

"C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 69b7ac669970bcac86b884436df02740
SHA1 871e927aa8379185d88d69fc4e76f7406a48f7ef
SHA256 0f43e00998862ead40119b60a51dbedc1e6d618c799e6a7d06be9663ad631ad8
SHA512 2ebef3d3c9498d761dfad1859ed43039d2c2633e85978df457e787f11de73ad731bb46ed1a076521731fbf916cc8c149b5ec2936e19eb7ddeed16f396f087740

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 ec9dd564cf21c15bb61640bc0de0010b
SHA1 2b3235403193a26c8eabb419bd0792980900390f
SHA256 1fc530e0f0ccbc68541a8bdaddd997e8e8737b91f709e37a7713a92c6f255b42
SHA512 81700bb62f672d41a48f57a5b2c20632a483a82a4417f2cab354db3f0d10eda5e7b7e3dd36debe58ef43e5671e240e253c438be1ae6f10fddfa923603dc4ca4a

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:35

Reported

2024-10-05 19:37

Platform

win10v2004-20240802-en

Max time kernel

119s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe"

Signatures

Renames multiple (4671) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Common Files\System\wab32.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Internet Explorer\hmmapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe

"C:\Users\Admin\AppData\Local\Temp\0c8e66e0e5766fcfd2f21504f895c6711c06c3a4077b055c60d4c1def99e5497N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

MD5 2937c3c501a5f88e1acd32221d7b6779
SHA1 91d6ab303dd43ba36729b8b0ffe274114df1cf9d
SHA256 e750c695e84274ed9be42fadd157ceb09441ea3ed2ce59a9b3b4c20a719e8c86
SHA512 f7b8326839d54ebb90bb4120f5c9c248f7b524ca73c17691001f1a97ca7f51619d761643919523821e40b9f44fe84f2835e18bc5986a931ecfda8482307db861

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 21d2466ea08d06b8a90af584188e9f1e
SHA1 663e3cc948d88e80f1357f27f3370d45bd140f73
SHA256 6812f69d86e3ac960a8d94547140de5a71b6b77a0aaff43eeee2e2b4b7cd2121
SHA512 8f93e2ec83d985c53c9569e9dc8e837abb3d94e5e5e04e28acd928ec0d89c00525044f1a9c6cdb587b31e8f21eeeb3237d9e35f2d99d5ab60495a8b4fd1c6400