Malware Analysis Report

2025-01-22 20:13

Sample ID 241016-yafdasybjf
Target 2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb
SHA256 2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb

Threat Level: Likely malicious

The file 2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4860) files with added filename extension

Renames multiple (3460) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 19:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 19:34

Reported

2024-10-16 19:37

Platform

win7-20240903-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe"

Signatures

Renames multiple (3460) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre7\bin\orbd.exe.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\RegisterSubmit.bin.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\PublishDeny.emf.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe

"C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 9576d0a94e1df3f5b064332ef314f9c5
SHA1 0c836c6416c39a66115ece256067a6bffd11cd2c
SHA256 65a905442386d158515a19ca121830442a7361ee1c66025fc0579c768844e694
SHA512 ec7d79f74bdbc34a7e0e56846024ce03c1d77901e246ea6229f2694a03a539045703f4e792334d6733b4b157e7ef2f28d93ced021cb842398bc40748365a379e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 63590d320396a4351d21a0981c74db1d
SHA1 10a8c30fce87f215f282521ae6c1be9f8dc60ab2
SHA256 97e02f7ec1789dca7df36ab88c0067b3d9291c0742a129dbf51b0d5b8de5636f
SHA512 8a80c8ba1e4535e4983048374f06ae55b0d5f744d4d0d15813cd88ecf1420b674865063275da4496deb03a1606db865255e9ee2b68a4fedc20eac00625456a0c

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 19:34

Reported

2024-10-16 19:37

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe"

Signatures

Renames multiple (4860) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\Services\verisign.bmp.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe

"C:\Users\Admin\AppData\Local\Temp\2aac62fcb0ac3a22b8d9dd163c2032bb90ffae397d64e8ccb184bacd8e8115cb.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 4d3c86d81931a51f68d05ac42163964e
SHA1 dcc80088cbf5eb7d857f80b033ecbd738eab5a96
SHA256 e142841bf8e37e42356b5392ebedc4b252e957317cd9ae786262f47f7df4212e
SHA512 18c98c81c79a4a2929ef96fb3254ac28e1bedb5f96381437362f47a60a9c9afa625476eb4ae6671224a3b424c5a4345b8783687cb409b83505056740eebf2445

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 71da7319f165d30bd0bceea01b415f3d
SHA1 1690c101f75f12a389e02dd0dbc05dec880abf84
SHA256 245d57d8b3f9d8ca2728aa8587e5f911d14829378259c8126956f3d3956fd243
SHA512 74cc662533d78d8a37ce6f38a5c69e00f03c3d4a29643e7f30faee524fc3e6a9b14928ff09193f4cba005037394aff45fe56226a317d1028ef0c45b401ce855d