Malware Analysis Report

2025-03-15 08:17

Sample ID 241016-dzf1xavblj
Target 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N
SHA256 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0

Threat Level: Likely malicious

The file 6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5103) files with added filename extension

Renames multiple (3779) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 03:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 03:26

Reported

2024-10-16 03:29

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"

Signatures

Renames multiple (3779) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\WET.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\InkDiv.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d9_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe

"C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 17c989a28acd1d76a96439adb9ad43b0
SHA1 15af7a1723e9be406ddb2f3de34ad8d18087a71f
SHA256 55b65daeb932ab0eccbf3769a99482a551ab7d8f616d8924594279dd3537a311
SHA512 a47b335a66434cd09e9ef8287b224bb61c2ee72eecd14caaa76a63bc9cf0dd8bc586af87648b9b1d84d8790de8faeeaa59fcdfef921ad04ffac94e48e03a0abd

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 0e3ce169028deed045fd0c3d4a95fc7e
SHA1 27635089c2703ff8d8cc7ed0a6ff88f4b1316204
SHA256 570366ebf1f075f19acb078e15cbc218b26e54ad180fa2571998a1afce25480f
SHA512 406f9ee1a387392792e5346b844d310418ed11e2ab33607eb6a70b2d03e7aec5db4b1d7ed734e3a12dc1e6bc7d7d5d47ab48c3ed50019ba1ee087d8c25de596b

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 03:26

Reported

2024-10-16 03:29

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"

Signatures

Renames multiple (5103) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN109.XML.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Crashpad\metadata.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe

"C:\Users\Admin\AppData\Local\Temp\6feb1eaa504c3ba30f718f581d6b4f4795eae3a859898b3872dfb625245e87d0N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 678f33d1169c378b0ad183e0e7ccfa7b
SHA1 29d173a56975fda50a66679cde7eeb91a94068e4
SHA256 dcf745afa2d192f90586f2555f70c8f817b37b2355e2556d44341c7d3ed5023d
SHA512 131b5195293e830685bd6b83658890cb0ece00a891f184591d492b1233813aa9d27c231c2d9c5c75d0ed1e70de47e7bdfa47fcdc3ea2a4660765f4b0e57db1ea

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 b3893efc00dc0353a8eb48c8c364cf93
SHA1 a3122d9f3ed17568d7364fff342fc5af5216320d
SHA256 70189a0195275c949bbf00814384aa4800e44fa87d7051230377b052a8b085bc
SHA512 ead1f6423d0562a7f8a9913143563326590bc43a8ebd764826d1fc987ad99aff26577ee71645abda171e376ac09af859bfce42f392a4318ca3628df1e4c5d2ae