Malware Analysis Report

2025-08-11 01:48

Sample ID 241005-yg8cnavhrd
Target 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe
SHA256 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84

Threat Level: Likely malicious

The file 317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5196) files with added filename extension

Renames multiple (3759) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:46

Reported

2024-10-05 19:49

Platform

win7-20240903-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"

Signatures

Renames multiple (3759) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\RemoveOpen.docx.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\wmpnssui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

MD5 4790b348f47bf39cce3368b81689fb14
SHA1 4b756c65363aac9ad728c82b41e7c6fe080f7b7a
SHA256 46dc6ed4a4bee38cfacf3a5441c928c0ff0d5d94c694563264f50ebcc8dba7ea
SHA512 089ae88cc3f4b6ac53f3845e5de4e4d3a67435d1b13aa3de5188f488eeb0effb923988efac0db6f4505908d11d62fb928f2b2718d9d8899a9fd40d771f8aeca6

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 e71abfc4a33109c86d2726d40acad5a8
SHA1 2d20f732daef1e2a29692094829103bb16cae798
SHA256 8090d82fe2ead8c148a520ad67c537c5d74d6d9429aab5922a0e9e2b896a1e01
SHA512 f6e0dda0b27ff6193bcec787a02548de2c34c50f9faa597995d81ab967629e7d551bd75a6c152182ea26e595d5f9a94eb152bd9d39a83d4b10d92253767deb18

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:46

Reported

2024-10-05 19:49

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"

Signatures

Renames multiple (5196) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSPPT.OLB.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\DisableUninstall.pdf.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\openssl64.dlla.manifest.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe

"C:\Users\Admin\AppData\Local\Temp\317ae2fb378814de3c4ba5ac32a3143de34dfdbca43a95cc77ddb41646a45c84.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

MD5 530d02751e6cd6678bddd89baccdab9a
SHA1 6130dc1892c52e43b8aa20fa5a334caf6e51ad87
SHA256 460709b2c61f46ce0bb227c897998389c7dee4be772405f7d5c6a9203d836187
SHA512 0beb303dbafa54f146bb16078d4228804a76fbb637e560d017c0ac0008d1b3ed0852874e9c19635b0a75fb45df768e4b8ac230b2e74d79d1fbb029b079a60b59

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 adfce96647e669199ca95f195293c04e
SHA1 b271d2cb5292b813688c1966d1fc080aea00671a
SHA256 eea19220166a6cef28c6a52e0fae0a1ff1f123bd59014e48dc6008eb54d7101b
SHA512 e5046c24c4ae34ac3f75411d7b5a6b752981a3792645ea443a95d8dd289fd315f6b4c71ac63c4d87a51e2c21c1ea17a66da88683425eb646178a48a59ebb6d56