Malware Analysis Report

2025-08-05 21:56

Sample ID 241006-ljbp9a1eje
Target 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N
SHA256 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27

Threat Level: Likely malicious

The file 670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3706) files with added filename extension

Renames multiple (5050) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 09:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 09:33

Reported

2024-10-06 09:35

Platform

win7-20240903-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"

Signatures

Renames multiple (3706) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_dot.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre7\bin\jdwp.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe

"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 7957aa43642b34acd4eaa832b7627d66
SHA1 92dbe6228e5e60a0d500336e61d723284cd5e027
SHA256 35df43f06007badd8178ef565c9e4777a3a7100588411d0d54468810a99ae39d
SHA512 cb97b78d38d0dd2d25c1b02756509b2fc7550fc8b96082727f328d5102ddccd131384fc9332ea66cf2374d1cb132ea43e76e373d4bf491a8a74b3c38b788183c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 30ba06c7afceadb8612eed4858ed2a69
SHA1 b6e5011c6022efa9645cc4b2d08e689a7506d4d2
SHA256 7686c3abce6de96fb4299a6ff44dd6be33644f530567af13d769beffdb40e5fd
SHA512 8a70c2a3f650b9fea2a7c3b0d3795fd5538be1077790ad84c6dd8fd7b68a6b8db6ac606cf3455d3c8d3888585597b8a5a26537c70cd305fae95625234fae4149

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 09:33

Reported

2024-10-06 09:35

Platform

win10v2004-20240910-en

Max time kernel

150s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"

Signatures

Renames multiple (5050) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\System\wab32.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe

"C:\Users\Admin\AppData\Local\Temp\670388af40f8a01130c0c8461ddda00ba4032546ead72b2301579edebf09ae27N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

MD5 bb49054cd5ec1f8967c741898a08b4aa
SHA1 bbd9c6aab0057c1037c7b12dcd9bbd0edd969a02
SHA256 9c1e46e0753446bdafc82411e7e2eb54fd45091be16794951c667d427e5f3185
SHA512 8b8539aae64a943a8eeefb30a39a3a1c53ac76e1f16b68043c071a6038409eeafea2591e8713af8db1b0cd0d1d1df701dc3399f49ac4c48da45980775bd35125

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 0e86ec1601a63714c1c6184f1c1c397b
SHA1 1f40880bc204428913273ead88bde809e38f04b5
SHA256 c57655ed626215566c7aa6f0b04c7ed339c7bf3eb33a632bc15d791588d196e0
SHA512 8e05c825cb8868a1913211d2925c1ffbd57699de87c3814742241161824b7711ea96fb8d69a81372cdf91a784bb8902b527e5265f5c1501a51d72f327bab5366