Malware Analysis Report

2025-03-15 08:24

Sample ID 241020-ykjtgaxame
Target 833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN
SHA256 833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31b
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31b

Threat Level: Likely malicious

The file 833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4634) files with added filename extension

Renames multiple (245) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 19:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 19:50

Reported

2024-10-20 19:52

Platform

win7-20241010-en

Max time kernel

120s

Max time network

18s

Command Line

"C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe"

Signatures

Renames multiple (245) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe

"C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 27e80ce9325b55fe4d8cab7f8f77ba14
SHA1 c51cfb6be7cc492906be777756012e1aa3c6efd2
SHA256 438272c77f1667e47bcc2dc2563abbad71d050ee2d90648d201c7eef1713635e
SHA512 f19bfc8878b707c5b7ed174f861eec69c3ef9a3ff8d1d2a97f4e8d100d9242b725433b3dd44307bf40afce3080255636627cba614eb0cefcf91c76917414fc7c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 25f961d74a32c756dbc788a40f38b186
SHA1 c0b20f99f45c80445e77431c4f543ccd7994a73f
SHA256 1999cabca8e13605030218dff4daee58ba57377cbb3e872548c1d79016852fdd
SHA512 5101acf4d4397679807173497c8bd6bd9fb480fc06761fd4164ec0a437f75016631c41af7006e68ddd566ff9f2ac366f0b2e961ca3d62e36a23ac7f3f7d035c6

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 19:50

Reported

2024-10-20 19:52

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

102s

Command Line

"C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe"

Signatures

Renames multiple (4634) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\AssertNew.ttf.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-CN.pak.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe

"C:\Users\Admin\AppData\Local\Temp\833ffb74593408cdc66c7e2c797ce5bfd8ae103b75b4d880cd44b142efa4b31bN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 110.11.19.2.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 41848284ac2fd8fa226296bebd7f93a0
SHA1 53d47ab1b6f82078b9ce3fa4f574c933e093dd9a
SHA256 e76cb932f42c25d367a24ad5b7de021ab2e33b70c5ad1d1756733387bea1af52
SHA512 42fbfa663d31a65896e361be50ae9f41669273de7febd7c4b45be40f0c7a43830d16f6dc50201cf672ee429c72d1c0428c06958b6d66dd7a9022c9462358bec2

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9d9a55a07eda9677603b5763bee32d5b
SHA1 7b37935eb84558cb4f6ca6495f025cdca0d4a83c
SHA256 32065bf5476826983ac42a85abd093e4cd65abf3cfef4c491f485b62ea8e1c0c
SHA512 e03c4adfede0209a7c83665ac9f71a272f9c95f333f59c0536b8a4517418d2863b2cc3481b1b6f6986e2b28f029f94008be24c345579c8db305c6d2a5d7dc83c