Malware Analysis Report

2025-06-16 06:30

Sample ID 250515-h5597s1pt4
Target 6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877
SHA256 6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877

Threat Level: Likely malicious

The file 6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5296) files with added filename extension

Renames multiple (5197) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-15 07:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-15 07:20

Reported

2025-05-15 07:22

Platform

win10v2004-20250502-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe"

Signatures

Renames multiple (5197) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\CompressConvert.exe.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe

"C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
FR 142.251.37.35:80 c.pki.goog tcp

Files

C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini.tmp

MD5 ddbb61d41bf61a878fee800bb5aa03bf
SHA1 58a9cd413c0f3b1b10670e655c8cbd3f023c175e
SHA256 213801aa5290696fd2811c87c698f457625055e9dff48cb415a3e0edbd7544ae
SHA512 afc59b1c188a9f824c320410eecc0f2ef7f2c1e57f7a0930c23ab94c8237b36aee78f464cc7103ba3e64f72ac06ca9e4afa1eea9f9c24ebd90ea3ad3ff8fcca3

C:\6eaadd5e1536cd09900c16de307910\2010_x86.log.html.tmp

MD5 9d45a0d14bcc1c4b7965d5c51e27e649
SHA1 e58e5b5d8929ec022953c48feb4df3dd9e383e12
SHA256 203ceee86055d5425bd9bb0d83d238388ee2acd0e8f487016c6ec2270a5cbd79
SHA512 1de31b5d2675c64cc7d8c55621b11684cc4a1e67d7eafcc69fb81dc2968f7abb0f907fe885607d2c61e8a80ab4c46bbe943713a68352efdb110b4801537f59e8

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-15 07:20

Reported

2025-05-15 07:22

Platform

win11-20250502-en

Max time kernel

150s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe"

Signatures

Renames multiple (5296) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ServiceModel.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\LogoBeta.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Linq.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\net.properties.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEERR.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Net.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe

"C:\Users\Admin\AppData\Local\Temp\6ddd1b27e56a5551892f704640636dbac1dc773186b0f50bf54482efe7dff877.exe"

Network

Files

C:\$Recycle.Bin\S-1-5-21-2329104403-2882594830-3136665766-1000\desktop.ini.tmp

MD5 4be69077ca2920d4b6a793221ddffb0b
SHA1 4a3c059f6df1319adcd25bd329893cbf7687fe86
SHA256 85e000d82e4d8c246f3666bef101bde91e36a9086c030a28de618544dc441e7b
SHA512 7818d23342f7eca3f28fa743e7c737cd1f16faae5031c2e3d29e0a422ed0c5389d27fe89e878e973a5c337913a2207f8c564e4ebc65cda99d8f6b02ebfa1c3e4

C:\bf6fffe43a1488106117f05273896fef\2010_x86.log.html.tmp

MD5 6a19c9aa2aeca8b7943f71d3ddfaa96c
SHA1 840bb82d61ae17ebc2428112a39d3fad955d08cd
SHA256 f4b0842abd60ec4e471df8220b93076e8bae331f709a342485ad806140a16477
SHA512 90da8ca7fdcceb7599a9d5025df2cd75eefd66ca9dc588ce86fe3aab666fffbd16837fdee94ad55c368729d593fb5d0373c37d8a5e82d78f128c3b5adb4384e2