Malware Analysis Report

2025-03-15 08:13

Sample ID 241016-jnradsvamq
Target 62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN
SHA256 62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219b
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219b

Threat Level: Likely malicious

The file 62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3407) files with added filename extension

Renames multiple (4677) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 07:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 07:49

Reported

2024-10-16 07:51

Platform

win7-20240903-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe"

Signatures

Renames multiple (3407) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Internet Explorer\networkinspection.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre7\lib\sound.properties.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\ConvertSubmit.hta.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe

"C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 76eed8c78809aeda4aa6359067d7b47b
SHA1 fdc72a849883ebf0c6fb68ee7168b7cd6c143abd
SHA256 f62cdd8e4b126c6e1faf0a71c33947a42317c3b6f2b0d14f834c4c650859fa81
SHA512 ba52ef0ec3b775249f853fb301291de9640b8d393b5d30af94ab0b4c4f92a67923834962de7818930d427d57efbf1eadc0bee363311de0f8bd8567a4b7cfa022

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 134d0ee955635ad20123b0f24fe17436
SHA1 d8a228918d2699005239f9010d14203082df52d1
SHA256 565fba62263f711c95533868de85309f77907c3c94c759d7c5baf8b4cdb63711
SHA512 935490797ab7bf82661a67346b8d029b05519a86c44e471bbb0e8d11ad85b73a1e78b0ff12b636d0c7ae8fba18ad37a6ede1792fd8982d9dbd88e8c20c2c5a59

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 07:49

Reported

2024-10-16 07:51

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe"

Signatures

Renames multiple (4677) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\ExitRedo.mpv2.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\ApproveUpdate.ocx.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe

"C:\Users\Admin\AppData\Local\Temp\62eff17da9d669c1ed8a199298cfd92651944a6c27544148161534e0b80d219bN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

MD5 b96ccb8e9f28b0c973aea4252b432c8d
SHA1 cfdd04e921422730780cb4114fd13eb2a5e867d5
SHA256 17675e690b39f8c75d0ade0eabeb144159a3828156932b4819ab0a5c09eae564
SHA512 16b64a7c4442e3870124542362335581fd06f513f5e4596c3b1ca097bb0f09a661aabc4658df85a9ec3718e8ee4d5ca261054f055aef0e3e54dddd8966733313

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 5cb33885fb3fc1a4d9a44bdd87d9efd8
SHA1 d43422335c77c7c39c455299e654e35ecc7a2356
SHA256 b5d081e521f9d32ce4568d763fe1ec0b3be50083602ff62faf9763e5065b8c6f
SHA512 3d0d3e5a24ea31f8d04a8b63d6065dd7f45380bc4e183fbbacc2f7baa26568a7aed01254914e644f9c652d28c998b500659674752f20f716655c78ea0138f8f5