Malware Analysis Report

2025-01-22 20:17

Sample ID 241020-b7tkvs1hja
Target 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N
SHA256 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58

Threat Level: Likely malicious

The file 390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3715) files with added filename extension

Renames multiple (5042) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 01:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 01:47

Reported

2024-10-20 01:50

Platform

win7-20240903-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"

Signatures

Renames multiple (3715) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\SkipProtect.mhtml.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\7-Zip\Lang\sq.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe

"C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 b4f33c0efac6252308ca8d1c07e9f78e
SHA1 e98d4269345b5a348f20abdc552939462de75a86
SHA256 9b0e4dce4c0d1647856ec4d3230ced01cb8e074c5e147b4249c4c28ccfb9aa57
SHA512 be776ab38d1df7fc52d6fbec43bda63efc8982c0a9b696e65464b52f2cfd75f01ad02dbb2f7868deb230cd23e608a17e83ce61b1f4deedbb44d2536586961ed6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 7577004dcf70385ac0bb033061203596
SHA1 675730130ec12291e33caacd49d5a6dbf8508c41
SHA256 4903fe46027fe17f04b6c7fb72e2401ca9cfcb08073214305d749de08b74f728
SHA512 bad69a6c36ebb90c699f15d5878586e360fda0ad989cc31cc95287f9b796d385e6e9c0fecf41da4fcd2c17d6cb4532a5c4f18210d31d6a67fd430492ea596eaa

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 01:47

Reported

2024-10-20 01:50

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"

Signatures

Renames multiple (5042) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\System\wab32.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe

"C:\Users\Admin\AppData\Local\Temp\390fcc4ebe35e8055d23c33c766d4b5d8fd09ada2d7afee1112d461c5e7d9f58N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 4f20d0d9b98d11e48c6f1ee499cb5eed
SHA1 087072db049dcc18358e7d4a7cfa3105e69803ad
SHA256 f676ed0404af12db626bd0f00b8984d02b1953ae670ae847c5d828948bbdbc0c
SHA512 e73cb6a9d6a628d02d73eaa3abf7768edc39e6598c5b41797a91172a802632aeb21563e076a5968e524ed84b34bc06c35cd3ae06cfbb23209237cfa6c1f19a7d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 332d8087d7374be660babd615c2244f9
SHA1 2d3e998716042a345c72d5a47114cd902c706408
SHA256 d30ef5d5984f64bbee3e0bebac72c2145923ef101147d9b4537380f058ce93e1
SHA512 ee82807361c562c197811d5d4199f76fd764ab62ca3a760f4cb92fac6f61a5652b431aec1e6db1a171dcbaa7670d0fe9f63eca408bbd8f9ba059695869df23bd