Malware Analysis Report

2025-01-03 08:32

Sample ID 240610-23d8gsvajb
Target 6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913
SHA256 6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913

Threat Level: Likely malicious

The file 6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3703) files with added filename extension

Renames multiple (5197) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:06

Reported

2024-06-10 23:08

Platform

win7-20240508-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe"

Signatures

Renames multiple (3703) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Defender\MsMpCom.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\SearchUnblock.mpg.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Defender\MpOAV.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Windows Journal\ja-JP\jnwdui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\bin\kcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe

"C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

MD5 7a3a1cf7b288f5c550c5b33a2fe3ce90
SHA1 f2117df975a0e4d43ce68ea6bdc004b40bcaf8d7
SHA256 78205a6ef0344033a86e22256f23364cc02d57c3155003e11609e1ebd06b3b46
SHA512 f7a6388011cf38d9426af2b4006ef15ac97af26c079cc6ab49bc94491fba198bb5528f11538d5d2350257515aab85ebba7d4a6adf831316005603456de4050a5

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 3a826ec76a98515c1e6791c922f7c0a2
SHA1 26465f38e3bac7c49a4ca5b962f1b91827e13d7c
SHA256 51cb85f7e61c76e19d5534fec1f17063a4b935f2ef0a89e1682e99d8ffabb44c
SHA512 a61be5df008989f7923906f2583373383e9b4735d7a6ab65298f9d7deb63ef7de3b5f7f6294a6ea5b0a36b2f841eb391176d7d11ec1d7a4bcffa09967c984f4e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:06

Reported

2024-06-10 23:08

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe"

Signatures

Renames multiple (5197) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-LIGHT.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe

"C:\Users\Admin\AppData\Local\Temp\6aa14f371efeef81bc1308d98d06d64d84f683e677f3b229cbf37603761fa913.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

MD5 68414df8f957a048a1d96c75a77964a4
SHA1 4eaa11253df48ce9cbd3e7fbe14eeff1710934ce
SHA256 d6bd7836fbba8e66f1e356062b9368af09b0bd91e586841d3e035f4c572bcf0b
SHA512 f49a7997625090b6c370da5fe6f79debd6e568486018b795c8e12f0fe2be6645a2abecabc5b01c26e6fbb87960ab471efb722f63b404b233fd8c8fe374ddb9a5

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 7e2f70853ec52a7382680fcd05108175
SHA1 17676f7e1d57ab60743a0c2a0a6f892262667973
SHA256 225db3d8e9491b476f0c390666b4afcc3d80fac35d672e95839011f1c2626204
SHA512 99474c945729a2d3e36e2eee60b6e2fcd0928c8147c3fcf98e1acdb7d0270ec1f1c6ce5a22cc7bee4fa4080e7e5c2ccade157acdcf81c9da7d6ef5615084de30