Malware Analysis Report

2025-03-15 08:18

Sample ID 241016-hvpjpssfrm
Target 3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N
SHA256 3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742

Threat Level: Likely malicious

The file 3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3774) files with added filename extension

Renames multiple (5206) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 07:03

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 07:03

Reported

2024-10-16 07:06

Platform

win7-20241010-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe"

Signatures

Renames multiple (3774) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DBGHELP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Media Player\WMPDMCCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Mozilla Firefox\defaultagent_localized.ini.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\timeZones.js.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Windows Journal\InkSeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe

"C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe"

Network

N/A

Files

memory/1700-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 f093fb847db5334845e52181dc1dac23
SHA1 bc1d1f60d0af4f0506d263155ee864f929e7aae6
SHA256 77260e5d66a38a1a8d4cde9b6554f2f0bba2842faa2a80cb87c599821cc792f0
SHA512 2eae9a3f53b9032e73237e0d9a51edc9d7da402bc5e755d36f87e5f358f30863baeb372f95f7746b350c732cdb1b8fa88de54f0106e5299ddcad3de67db808bf

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 a82e0fcec1e135b95e731c90eecb7796
SHA1 e83afb5ed29e798f0ec94a3513439320dc92ce1d
SHA256 929674db61edda7e59b564135a7361678cb61ab35ca547730da407e12f6106d9
SHA512 6199216974c6c0f7f6280ef49ea8b8e272ba3a014ae031772a49910996b0675b606ad8fd075af171f6509e1cabf99b266f44f02ace25324c1b96e97a461870b0

memory/1700-70-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 07:03

Reported

2024-10-16 07:06

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe"

Signatures

Renames multiple (5206) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Wordcnv.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYHBD.TTC.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe

"C:\Users\Admin\AppData\Local\Temp\3665c127076eb40cd3c3de1ebc14e72ec7c7bb7383898ae1b975bcf169153742N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/4520-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

MD5 8b929e3b909b5bd5538ffa17f2339c4d
SHA1 8a6333f8e1102bf0b97adf731c245a68d0d7600c
SHA256 a4c687743e0b9abb380359d49cc472bd026f9eec4a88f15205d5e29ef47f2b93
SHA512 7eb158ceb14ba63217273be8cc72f9fc5db51459a3213702bcc0ec7f7065849b03a9efe94b34157177fca96e9d23487001722654dac0cd9ec7cceb458307bdf4

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 460dccb98e3db77fadbe0420ccf60215
SHA1 af2caaae01f995e68106c4da9a2e9b1dd0cbfbab
SHA256 8b18dc6a2d1fc358d1d9d11bb5c565d97e5619fae30f1d8a5a80c42b065a080d
SHA512 dd832d3625c57178e046bef6a0e1a37bba1813edeac86b5f1ffbb024ac119d9ec79add3aee9856eb56569d289383343c62f91a810a4a064e62e968f1fd6cb556

memory/4520-784-0x0000000000400000-0x0000000000408000-memory.dmp