Malware Analysis Report

2025-03-15 08:17

Sample ID 241016-c49y4sycpd
Target e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N
SHA256 e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0

Threat Level: Likely malicious

The file e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5027) files with added filename extension

Renames multiple (597) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 02:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 02:39

Reported

2024-10-16 02:41

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe"

Signatures

Renames multiple (5027) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\imjplm.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe

"C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/5024-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 57cb439d05d3eea8ad4ecf0740ced269
SHA1 84aa4ed62c67268f6953029675e78a3200cfbecd
SHA256 4dc9e7c4258038809db71b02c9d3c95f7d7fc034a9a947f6dc03ba2812fbcf23
SHA512 d2d3112d5af52d4a0df4254338b0e093823bd2055b566c9181c372197779f771d2ceb9aaa02f3d3d8a003ecd35d7ee583f0922587b9300a44aacfba002d811fd

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 2f9293f328811bf706ff214c9f1d9d7c
SHA1 2489d7e9cadb3077bd4ccb9fc50bb17b49dbf40a
SHA256 37e3a58e15905d5e8a1ee7f568cbd6ae8516e2950f8730e332981406f79b1ff4
SHA512 951118801bb407b69ea3e9bc24452b197da8cda0ac2c48dbac9a9f25d99b81cab0f38fab3c0cfa41d1543f6b1db0edaebba3b40cf3177f0fc1b23c78d592fb2a

memory/5024-782-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 02:39

Reported

2024-10-16 02:41

Platform

win7-20241010-en

Max time kernel

150s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe"

Signatures

Renames multiple (597) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\PipeTran.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe

"C:\Users\Admin\AppData\Local\Temp\e11018210b56b8a99f392d68cbde4274171f138892b2fe9c6cb1c3a09e81d7b0N.exe"

Network

N/A

Files

memory/2244-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 eb2671ba906ede6d7db334f614e22e57
SHA1 a281f5d0de6bb58be6a6a1db5750302aac9328d8
SHA256 6e2fa3ebda6f78aadc9a557a14f17fc26049e1986c1c6a12253a817057e0acb0
SHA512 7093fac570a25dde6e4446a4230b2fa1ca878561bb9bfc4065d56375ca326376c78f865ce4302ff5487bc26e930c7b807a70861a6bb05232186c37bcef2c719b

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 64249fdebe228cc53f2a0d0ef9cdd018
SHA1 35c33c97c4faf1fc305c7cee6993e8c301059821
SHA256 e88d3cea98f1dadb243fc2cf520b29168840d3a9c03db368a0a1dafb880258e8
SHA512 28d560ba14cfe1d54e251bac56133a031b6565c29b6a14e6f19d1c802e0be32d6269e51a27069672ffd4e7ea5a32c6eaacb258f527963a7ed462dcdbb0f54e5d

memory/2244-22-0x0000000000400000-0x0000000000408000-memory.dmp