Malware Analysis Report

2025-01-22 19:58

Sample ID 241016-ya74baybnb
Target e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN
SHA256 e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741f
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741f

Threat Level: Likely malicious

The file e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (2741) files with added filename extension

Renames multiple (4602) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 19:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 19:36

Reported

2024-10-16 19:38

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe"

Signatures

Renames multiple (4602) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe

"C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

MD5 b990525f8344687e90fa2b1821c2b7d6
SHA1 e92b96790bcca79f099950e497c489b760c1ec7a
SHA256 85dece915d81b0735e98086927ab0b9935a2ce604897c26ae46fdc0f2ea9dbf5
SHA512 7b23d8444d6a1b45f5ce1c482f208aa5dc9a82e5c54fd4520e99a661585d57c4bbe99a37832b2ea1ebbb450c5d386d799d0cdba1ead63d906faa8903eaee504a

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 fc7974bb1ed9b1ef847580ea84831f99
SHA1 be7a0405e356f5e702036e665b845078649dcb28
SHA256 c8d03d8c14833bbd7a8601edfb5e99a132d685fade37ec351d3358e84a959dc9
SHA512 6f333177609930b5771a1b06637904c5c1564c631a0a490569b465742a907c4b1abb4ab27b651827848021e33bc23ec677d25e7df64185f12d6ac2f990b7b611

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 19:36

Reported

2024-10-16 19:38

Platform

win7-20240903-en

Max time kernel

101s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe"

Signatures

Renames multiple (2741) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\EET.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Internet Explorer\pdm.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\bod_r.TTF.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe

"C:\Users\Admin\AppData\Local\Temp\e2c01d14bb49f5e8a8078fdf949fd5b55bb115bccbfb85aeff3beb16be36741fN.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 af46152233064d59c5b59a6c64ffa35c
SHA1 42767e28e63e64fd7b378abeed8fcdb37646f23f
SHA256 f5fbf7f25cffd948f6eb7f1127c82407fd9d774696f1d48ca6f29227d1b20434
SHA512 b04cae8e162ba9fde4a0edf4ed0b656c6585c8d4205ad9c92482c2355926a93da14961cfad86396612f51dfb05d94cd92d723eacfef26e3c829b5e59d3eb52f9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 cc3e447569b33d86d63296cd516eedf4
SHA1 c1b854e04a9ee734d2d32760c92b18a5c7b4925d
SHA256 1e331381fbe9dd521993ff2dbabe9e21cdaad272b282c5d22a880216ad9e428b
SHA512 f111209f30c52322e91b6720f1955251d6416afb1794c16fd5c49aa2e43e4341711b12eea8b6d02806c64d3753ba0ec5e44535730b4bf1e70bb1078d3a85ba2b