Malware Analysis Report

2025-01-03 08:32

Sample ID 240610-22fd6avcrq
Target 6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a
SHA256 6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a

Threat Level: Likely malicious

The file 6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3520) files with added filename extension

Renames multiple (5184) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:04

Reported

2024-06-10 23:06

Platform

win7-20240221-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe"

Signatures

Renames multiple (3520) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jre7\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jre7\lib\classlist.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jre7\bin\jpeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\11.png.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\PushGet.ocx.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe

"C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

MD5 106a23c14d0f04fc3d38ee3865572819
SHA1 bd4322875575a5060f1db1b30dfad060319360e9
SHA256 cf72d802a42717772dcbc806b4cfdf96da26fd9beb08562def38e0489c0ddc9b
SHA512 10849e340999709bd1ef12caff890ad1bd9296b14add80907aa407e4c93005f71aaaef0814701892e3b7761185ed17e4fee14532f3cb7ff0ce1defe4c5ab7a36

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 dc3030ca109a24606322e3726b5fd5db
SHA1 70abdfd6a120d98a3f12b802ebefc479ffeb49f8
SHA256 167283eab298a6426a8c7e8fba08d739daa5943f4b9d170a5b24a9dc5e11c3fd
SHA512 de04b14b8070a344e201224e0442188bc2767967d4648ea1c73837c53d89d6bc46dd872d056409254ee0394bdeac707d929b77b3477b0c14d1ee7f1140bbab8c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:04

Reported

2024-06-10 23:06

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe"

Signatures

Renames multiple (5184) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.DATABASECOMPARE.16.1033.hxn.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe

"C:\Users\Admin\AppData\Local\Temp\6981d3ae4b84361536cc3c2079b54da9981958318cf14fa3d0dab3db85e6168a.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 138.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

MD5 1a4a2dc37b1c3f66dc53ffcf622da288
SHA1 f257da3d15cbd21d8f981910bf5998ca61d208c6
SHA256 51021432602e35940ee08c028297a6e447501c7c4cfc75e3127ec846f2d2a32f
SHA512 31d64c816fb74484c650372a5d3990d82edf41012b1d67d3a7e730744283075590e8a03f12ab75eb6072b06a301c4846c91d9ab2de4e5b87a26abdc308046866

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 0b4ec02fd1aa644fd23823fdf95f00a3
SHA1 acfbdfb5ab42d05d5a864f9fffffe4b859a4572f
SHA256 6c212b426a50cccf0656f27e575f729d34035c3749f257ac7d51acdbaff520ec
SHA512 133d26f82b1336968fc41ee4ca84cce1156c894c38f7515ca2616d0bb0aa1dee0d0180a3568a001557a0fea43df989f4d2e5b7109e14c0e2cc0dfd14c3d62e71