Malware Analysis Report

2025-03-15 08:18

Sample ID 241016-hk2raascpj
Target f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N
SHA256 f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751

Threat Level: Likely malicious

The file f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3708) files with added filename extension

Renames multiple (5091) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 06:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 06:48

Reported

2024-10-16 06:51

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe"

Signatures

Renames multiple (3708) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\wab32res.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_left.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\init.js.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\msadc\handler.reg.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe

"C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe"

Network

N/A

Files

memory/1964-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 3eb0f333cbff2e88a2111536c554bbe3
SHA1 8cf12e85bdc673a9199f34be1004b21125dbe779
SHA256 ae105634418f4e09f3158e5332b96dbcd3479053144b85e3709a1a17d15b487e
SHA512 601edf03e1b64259adeed6481bed4c30b89105a81bd71617e57a5fbf31e88fc1dc1749bf1956e32fc201afe8a022cb71add84f65656bede2712926f78070fb64

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 16421b0a323ece8c033313b2d0d36274
SHA1 f78e77c9c0240d86ec602c131a19bf828accac67
SHA256 49fc708ef8009bf521680ac93dd337269faa56744f0a7871208d4487bf28823a
SHA512 b1ebc323bd2b783bfddbd79ed14e789be3b58ef4d89b1eaa4df173b5325c2320b80f5235d6545933db8181eeec7905a4e787455e3691df82fc44a9af7e14ad8e

memory/1964-72-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 06:48

Reported

2024-10-16 06:51

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe"

Signatures

Renames multiple (5091) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7es.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIE.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe

"C:\Users\Admin\AppData\Local\Temp\f8c2f8438d6721724c4c85254ba909385235e19a933f8f742a264b9857e03751N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 78.239.69.13.in-addr.arpa udp

Files

memory/1728-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 c8e72358f49a80cacdd322a3f4baa424
SHA1 898b36dad9056e3f64fb355c1be857f563524b11
SHA256 205d34bb392869980cc94ab3c333e35af61a0774175cbf9689f86a76e0fd1014
SHA512 da9f7d91ca1fc08810794a82136d5395892e263d970f48773b3308cfdd8cd132be067bc1f9702dfef2a001eccf7a36bd1d812003ce4ae8970d264461d299e5e8

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 8e9fa850f790700bd6cccf800fce7bca
SHA1 785a3eee60ee46ab4b8591cecf06541ebce59cb0
SHA256 e315e46ef432337e31b4b026695e67b41d9e84333b52ed7dd033c1e987960600
SHA512 3344f4cf4023c9567f7d881f991092b2a16c82cba3e6e73565d44a7e5ddb03ea92927775c82028ec4ccd7a862753a220b1d484439527670883b310e23afd5646

memory/1728-678-0x0000000000400000-0x0000000000408000-memory.dmp