Malware Analysis Report

2024-10-24 18:18

Sample ID 241018-d48xgsxfpq
Target d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a
SHA256 d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a

Threat Level: Likely malicious

The file d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3458) files with added filename extension

Renames multiple (5012) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 03:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 03:34

Reported

2024-10-18 03:37

Platform

win7-20241010-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"

Signatures

Renames multiple (3458) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\bin\jsdt.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre7\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\DVD Maker\fieldswitch.ax.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Mozilla Firefox\mozglue.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe

"C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 51fdcb8134b118b97dd4c5381e28edf5
SHA1 604cdff482e61e98defe29b8a75a52c42c0dd43a
SHA256 bfc25c361c77a095454278f11392c45602f4667c9319ece138419e4f0f7c7e63
SHA512 452f0be49d3d0778cb4f58ebcd8172bb53b427493c751e60aa822c834fc06137c6d20f3adc7f3462e738dedea4d302a428968722eb95bf5b7c9ec0a07580c978

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 22ef3645280c17116ddc567a0cff1a4b
SHA1 abef9c84494b4f7115107984915bfaec871f1c58
SHA256 7d5699f9b66960bf4b28c4bafb44edaf68ff40a51ea1bf7b994222989fbdc9c0
SHA512 b23d50ea90483e5e8f7c0856eac64f71a1fdc18b383f8af875f06bd30347b1693005a4306fdf83a1fce832f1d520b00286f0e9066aac4fd1ca7b02dff9abbc78

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 03:34

Reported

2024-10-18 03:37

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"

Signatures

Renames multiple (5012) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk-1.8\release.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogo.png.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe

"C:\Users\Admin\AppData\Local\Temp\d8612e0e75a79b5a916a9250038e4dd1f388f4ae5034dfd54570aba1c6b2d38a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

MD5 4670fa55f0b1bc70378211793fe00585
SHA1 1818b4153f510b4098614fa9f9ac02e2d47dbd97
SHA256 6ff3f606d4c2fd45fbd48001c735c739fde9ffaac00f887bd433d494b9ca8483
SHA512 a35715141e6b21be2bfa781418cf48ef592fe647a7d31c5b9bf9307120bb561de15dde9fdd9c1fa7756bd864cc9ca47fbe22d4488098ab8aa1055cabc01be382

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 a84a9d08a25499516fea13a424c13d1e
SHA1 8df6fbd87fe6a5cdbd2d1eeb875dfc1e17346297
SHA256 a1bec668e05eaed0f1aeb375d8872c2fea3f9dfc0166811ef8e9839accfcf910
SHA512 349623c9d2ed3c1b770dffcd6b167d26d76773ec77d14cd60f4a29110c3191129112471c6862eb5b308be1460026f5918e3f695833db4781da50d035f610ef5a