Malware Analysis Report

2024-12-07 10:03

Sample ID 241114-a2pt2svqgp
Target 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe
SHA256 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93

Threat Level: Likely malicious

The file 2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (2734) files with added filename extension

Renames multiple (4372) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 00:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 00:42

Reported

2024-11-14 00:44

Platform

win7-20240903-en

Max time kernel

120s

Max time network

22s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"

Signatures

Renames multiple (2734) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DVD Maker\Pipeline.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe

"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 c2749de31d2d1ca4a1727a9189750e22
SHA1 0ab19194290dd36bbc2c283b2bf07fbdae0e3288
SHA256 f7372abef11e2ba1d70ac356b939aed32927dae163152cfb404040ed240dfd9e
SHA512 3a603391d88f075ffdfdf276c981646fc881fddb26ae9c448bf2f06ddf5c4a331071f93ca0c667bfe7a6f2f53ca2e37ce460043836b1a3e326bce535c18be124

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e5b6f63f5863f5bf94ef6f6187923b57
SHA1 c7afae3c17470dc0887ebdd62f96f1db9532e093
SHA256 3efa9da09e45221101469e8dc5fbdcdcbe47058fb24855504014b3abb1dce830
SHA512 c3c1ef2579e2307598dbfd22ecd8a6550ed14f3f664326d66bdbdcca7653a6b49ac8a574279f6843cd30ad505b85e2c144bf0d289667321baa640c02ea0e758f

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 00:42

Reported

2024-11-14 00:44

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"

Signatures

Renames multiple (4372) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\DebugSkip.raw.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe

"C:\Users\Admin\AppData\Local\Temp\2d94ce404097cd9b07b3aac01f326fa5f93b1421c7ad7813526223ebd06fbc93N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 182.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 0392594d5b9040358010f9557e55e855
SHA1 7302352cac03b6d8975a8989e5d204b8b0f59893
SHA256 42dc36fe5a433693fee543298287eb0dfac6f8b8dada6f8cae77ad9417670164
SHA512 59373cf074ab0b0bba64d217543c2b9e1a7f269d3e2f26d73c9e4bf5ade5274172ab30c39443e20f8d33c01f7bfb5dfe67bcb82000d86dcced4b32f325f93d03

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 22ca865956960861445b61e854bb51ef
SHA1 facaa80c66276258d0744291217633bbab51317e
SHA256 8ae613d41e0061bfe4c1a41d4c751402bf45f93e0aef5c4d87343066074664c1
SHA512 e51e895f9e3d1ad5299c2f87b0a412878a6b03dbde7de9012540187c1c370bc1de2c97e0e750899bed0be56684bb0701b56a32d55580efd0f4efb2b1a36969b9