Malware Analysis Report

2025-03-15 08:28

Sample ID 241020-vw1dtazfra
Target 0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N
SHA256 0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509

Threat Level: Likely malicious

The file 0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4075) files with added filename extension

Renames multiple (5199) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 17:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 17:21

Reported

2024-10-20 17:23

Platform

win7-20240729-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe"

Signatures

Renames multiple (4075) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\DVD Maker\directshowtap.ax.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre7\lib\flavormap.properties.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\highDpiImageSwap.js.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe

"C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

MD5 dffcd5e202dc88f2e9bafbf5d20ef989
SHA1 ffc136020b781096f4ec6660278feb6f4b6c78e4
SHA256 df4a2a4a60af328412d0f6cd19cb51b8891202e287333c1b070889323a5d7054
SHA512 c35c017b920bf2a4c62e7b788c5ae6c59de0279d4e4d339d6d1f444d2ff7d8eb51a0c536592cd95d18e412bc0f3314c141077c7243bf3d9d365daf94af2406a6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 7c1c28369d8a10fb277fc601e11930e9
SHA1 63d9aaadd4d51cbb90b06f2054d76c18c7d408e5
SHA256 8512624ac7a28c056099c533d21fcc3ccfea9dc3ee085450e96aeb6aef0bec6a
SHA512 fe4faf37644ad0c02b2eb41bbf812e582e47494c7b2ad9410c5f4b565d9967b9887f6c15bd6c08a594b13c32c4b9c5e06119808dc3b2a291d129a3be7ee794ad

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 17:21

Reported

2024-10-20 17:23

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe"

Signatures

Renames multiple (5199) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\LICENSE.txt.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe

"C:\Users\Admin\AppData\Local\Temp\0d73839cc58193c5742469110a65cfabf8e9aa65bb6334aa4080164ad22ab509N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.tmp

MD5 8d04b07dcbd1ecea475ff69228b0c041
SHA1 e9311ff867d0f44f3d6fbd4c47e2ae30f7dbf929
SHA256 250e063f697da3b0725f96d169c352ac1986ab1e09fa1647a9ff30be68e67858
SHA512 092c20ab997851f1f1829049c04f2fa4da40ec9bd68cb6b8a6f6ff24643d0b2e81285ecb790793113dfa07c2385459010b0525ac2cb4f43d09c089d46efa91bd

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 661fa0569b468935f9ba57f9fd427907
SHA1 8590f492bfbce23b5d69cbbf50fb9d0685e4efbd
SHA256 80ead10944f1e37b9e600693b3c5f3e1811977f6264a73c3cd843183f8394e1b
SHA512 794d542bcb907a477c283eddffc4af75b1c188ee6b6b970e9b00b009640821a8c097263160036dda632a58001075809a4c0456f2cd58b26b0d588c9eb40c0215