Malware Analysis Report

2025-03-15 08:28

Sample ID 241020-t8zsda1anq
Target 555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N
SHA256 555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907

Threat Level: Likely malicious

The file 555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3266) files with added filename extension

Renames multiple (4645) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 16:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 16:44

Reported

2024-10-20 16:46

Platform

win7-20240903-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe"

Signatures

Renames multiple (3266) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Mozilla Firefox\removed-files.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\DVD Maker\fieldswitch.ax.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\Documentation.url.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\bin\kcms.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe

"C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 d142ab4d838b8e111b2a69a13790a2d9
SHA1 6b532dbb69a101d81eb5e48bc58405ab2971a9ec
SHA256 7b179028fa6a0fc5763f4d4f79efd7280be87a7b1589eff4153c9c750e538b86
SHA512 6fa12857e9778ba81a964fdb193673065e37632877f9d34bf707f12c59e3a7d58cc095722fe308dbf97db2f0b75971cc1a4f95a3b69a180d6c8cdb31d18969ab

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 515f94e732221b70c072502336c16ec6
SHA1 47d315fa71c8e6f715e0a94856f24ff82bae78f4
SHA256 84b72056ff61a7f86df60e3ca1a880135b812652d6026629dadb743d1738f6af
SHA512 d2316e46215ef29757670f4f899d2e8f36b544f7de59a069599591b93ac69a6ad4b76d65c7583cbb040f8d9529ca725fa1d56e2d4cfc284d30fb85c83ff48ef3

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 16:44

Reported

2024-10-20 16:46

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe"

Signatures

Renames multiple (4645) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe

"C:\Users\Admin\AppData\Local\Temp\555e49d2b16ecf03e9cb00d533efe3946c30b50dd5242c1bb1b1056f544b7907N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 51533c267d3acbb655a4933a6ea89f55
SHA1 37ac4c0b34a545801683279054368c0fbb54a45b
SHA256 5c366cf7e429b69d7b72c22d629c6f8296409600c8fddd897d67889f3552b171
SHA512 42184052a296df25a54de72d1f4a174418e1d71733550fbaa5cce46fccd7eb22713259e7226a8f95b628711127c41c16434519ca2d7d318a59b87b3bfa9fb972

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9d66e7ab4d6fbb11505824b90a0477cd
SHA1 6b1c555b98650f291ba3cade29dc10a3334338bb
SHA256 8396232bd6cc52aa10c7d25f11297810117d848cfd2f88a435f404fd35bf07bc
SHA512 a8e4c7423305f5d9d36abdbc9e71f1662ed0b705164fbb3ad04bf5e1f5a39b67ad67d9dd11af264efedd3f3fa9a257e6796354104c8163ccc5cdfb40efb3159f