Malware Analysis Report

2025-01-06 13:04

Sample ID 240617-bma8sa1gpj
Target b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6
SHA256 b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6

Threat Level: Likely malicious

The file b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (4905) files with added filename extension

Renames multiple (3565) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-17 01:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 01:15

Reported

2024-06-17 01:17

Platform

win7-20240508-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe"

Signatures

Renames multiple (3565) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\WET.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Journal\jnwppr.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\EST.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre7\lib\management\management.properties.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe

"C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

MD5 eea10e7689ce124e60e5118cdfb57345
SHA1 53e219b045c1328f21694d14ae8d568327c2ec1d
SHA256 eb59689bd45c2194473ff8bde5f8d0fd5795f015fa3fc0a9428d19bce70e8043
SHA512 f0d7b3b8b5345c5cf06390fc4da27ada19befb1ba79004993b47d3580ef9cea081954e91b31e390403253728a999271b9d8f46df1e8c6363be027a7af029adfe

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e1327d2fdae03735f03480bc3d45bb57
SHA1 0aef134d2c5c248c9eb8c142649dde5477e260ca
SHA256 473f4c67a71bad2959654e0696a469db324425ae2f920a44c611f9a718061a47
SHA512 1710662bf60ed0ff6becdb0f38b03a45067b5262a4f93d5e288451ac03dfacb51016e20e4af32cb820433441800ff4a684c49b2ce9309734bd18f66dd1140cc6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 01:15

Reported

2024-06-17 01:17

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe"

Signatures

Renames multiple (4905) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\CheckpointClear.au.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\libGLESv2.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe

"C:\Users\Admin\AppData\Local\Temp\b46768ad101cf57f7ee6c75c3bcf3d5e48bd68e92f26aa04aed3882405f733b6.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4108,i,12594301322143882025,16832588342008839449,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

MD5 09350e4aa160e80e002bcfd2608d1db5
SHA1 d49cbc7eac0c17ba6b7d2617d2445abc59bd5f9b
SHA256 f23dada9988a83bbf187d10ebf7495700f523234ded11be45fb3b9dee426ed47
SHA512 5728582f1833c9288d26179deb0cb5aada9b4e3608745c4a1865709a1ebe7a4c7277187567b305262701f51a06ed7854d941bda15b61db764aa01f04df196fb9

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 e0ebfbb841c7380e0f55d1357b30838b
SHA1 52a02a42166814e33e026ef8ac12e9fc4b12451a
SHA256 372a9e0a064bd380de6327c35ee935ef647072356db9d138cf02572e08e5e0bf
SHA512 6bf1c711686358c003d29094709e5224295ff7cc16c9f6129c1bad1655265edc473faa81072217f8bbc219dd5d643c157faaf3564eba708d132f38701057df11