Malware Analysis Report

2025-03-15 08:17

Sample ID 241016-e1g52asejb
Target 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN
SHA256 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075c
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075c

Threat Level: Likely malicious

The file 6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5061) files with added filename extension

Renames multiple (3548) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 04:24

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 04:24

Reported

2024-10-16 04:26

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"

Signatures

Renames multiple (3548) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\calendar.css.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Photo Viewer\ImagingEngine.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre7\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Journal\en-US\Journal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe

"C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 986058f496af83ed08e5869842dd57de
SHA1 25b3d2f4a0e5f424fb30308b4da2aefdb81ac017
SHA256 4adf88581e7abde6f606d3fc3595fef9e513c44722a3ee6ba194f933fbc888d8
SHA512 588886e7bda34fd00852bbdcd6d7e37f7a33e0163c55c07885a848f4e74c200d233e01246da356799579724a9a5a1f547cd3da89564a3c38722dcd0bbdfa6acf

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 60c4f15d281b2dc90f38767940666fbd
SHA1 7da19666189f3e83ef19912a455fa9838dbb6269
SHA256 53ee57016291693b8cf7cda7cc0ad51d73b8e7a51f6d34d87b19cf1cdba999b7
SHA512 585fed080a3a5b13b91fe27ecc14a6d2c15c1e49ea2d897172c72e4bf791326fec60124f538b931d4fe61d92544f3683ba6750a38a3d2c5d1890bd2c558ea3fc

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 04:24

Reported

2024-10-16 04:26

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"

Signatures

Renames multiple (5061) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\AppXManifest.xml.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8FR.LEX.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe

"C:\Users\Admin\AppData\Local\Temp\6b56384ad00d277ee65381a1816c3845b3623b6b836dd01bcab43bd341df075cN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 210.143.182.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

MD5 2b2ac88ffccfd76cfec9c3e5da323dbf
SHA1 137f8fd887f04fd0a8d7a2fb2d529b9adf388897
SHA256 083ec9184080d15b30dc2a740d50c6f501ee2980cc7195c1a370b5cf39614a80
SHA512 60b9f47cc950e24386f53dc4b8695381d6179040c8ad4d43b8dd0ff0e5b7fdb9a0866d154e88817869e12d15bff8dc2af4c03175eaac84d8c172bba27bf3405d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 14048d7e7c4b68638351ce6a4753561a
SHA1 4e72cc85f0b0866866bad03238b3c3e618c48d40
SHA256 698404a18b0ef00acc49b8c6ec9d3f93d145983271a705b13d4d9eb09ce718a3
SHA512 5ff43cd1af16119c65ae67bd0e85fccd944cf6b37362b16df978b77dba29e5e67516cb5504f5285cc2884ad0bd7f4c92eef544de4696cc0d1716f2f66ad50f11