Malware Analysis Report

2025-01-03 08:36

Sample ID 240611-cdhryazdla
Target b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3
SHA256 b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3

Threat Level: Likely malicious

The file b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (562) files with added filename extension

Renames multiple (5042) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 01:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 01:57

Reported

2024-06-11 02:00

Platform

win7-20240221-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe"

Signatures

Renames multiple (562) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\Parity.fx.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Internet Explorer\F12.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe

"C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 5bd0408f0158acbc7f0c6d0d60d3fa62
SHA1 53a90a84ac05887b30e6cd3c5f39806df18faff1
SHA256 128748f1e0700d7e804ba4437cb0c63806429ba2a18fa0604c50a428bd24465b
SHA512 da5fe3a1d2c0ebe55c0040cd1434adeeb27395054cb076c238f38b66f33c4e7414497e55f73bacf855d8db0e578624d0ece1a0a24056836e9bc528bdebda4f2c

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

MD5 7b45d796de67e2df22a775e74c82b1e7
SHA1 60082f6f5961d91f80888ad7fbdbdded72416daf
SHA256 403751472111b2f5a3d50b06945bd503c94a950046ce743e49c232f17bf8083a
SHA512 57968c4101d7c3789716ea7e17ed9e832b9aa37842ca1f4acf700ed0f6452b4494739122e2a9bd6b2553b755eddc3cda5bc1a76f60dedad87dd01e30a6cb3a83

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 01:57

Reported

2024-06-11 02:00

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe"

Signatures

Renames multiple (5042) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe

"C:\Users\Admin\AppData\Local\Temp\b04e759e0574485ee1d1a34821b247b1d8d826d9cc2e13bf47e19df978a057c3.exe"

Network

Country Destination Domain Proto
US 52.111.229.48:443 tcp

Files

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

MD5 6ee46bcfb137284d714197ba32242e2b
SHA1 318538a9dd3de69f590326591a78cef4def12277
SHA256 fe2ca5602b83d1b656e1fc004d9b99cb8d152fbf287850728be8089c5e7cde48
SHA512 a114892d26cf14b5c3e79501f8d7c6dabf7875bbd6f2dd951e089bf86d1d45d6cd692370b8213b4382ca424e3d060a9de6d6c1ad6ddef9e6b7ae9831772ce64d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 3fb581b6f2e2beed7fd653844d61df61
SHA1 b03e560c3373970b44fd82aac73676636ede7196
SHA256 03566cf0602710abb50b1463b40d152e3c85578b1f6143e2fbf04518caa0283e
SHA512 81474adc0778bf4260f783d3285c383273fcf638c4dac0362d2725293d7907a7c67c8b65903c64e36baca4e4539da768af1e7ad418ce10c68f655df6fc36d169