Malware Analysis Report

2025-08-11 01:48

Sample ID 241005-yg1mtavhqf
Target d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN
SHA256 d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5c
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5c

Threat Level: Likely malicious

The file d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (3250) files with added filename extension

Renames multiple (4649) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:46

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:46

Reported

2024-10-05 19:48

Platform

win7-20240903-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"

Signatures

Renames multiple (3250) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre7\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe

"C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"

Network

N/A

Files

memory/2328-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 3feda6133549d488f2b527b435387154
SHA1 cd60d776fa4a52f6d850d5078742f698d29f78a2
SHA256 9f34723234e68a270a96868447c67e3744f1e95cbd7611c30bbb91f768388512
SHA512 a0eb6bc7e720b35f078984fdc2dbd0e5e08c324548b24771438ec63b054916362040f8216326d411c57f7ac133bab38501db18cf1119583be3570243d0615e84

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 0ce4546b679707f87ad98dfc217afa74
SHA1 bc03c2bd9a8a7b9a9c8de8a4246f792e049c2213
SHA256 4eeeeb3e2a638a2cb6b77df58c9e8b7891ef8b517f7d8f6b4a9eac884f78657c
SHA512 9ba7f32611b379999b3f6f9797461d12bd12964445b63afcee67a2a1ae7c4d0ef7d5381366b393e104708dc2609729ad17d47d18d980893b85dd41b7286572b0

memory/2328-75-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:46

Reported

2024-10-05 19:48

Platform

win10v2004-20240802-en

Max time kernel

120s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"

Signatures

Renames multiple (4649) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Internet Explorer\iediagcmd.exe.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Google\Chrome\Application\initial_preferences.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe

"C:\Users\Admin\AppData\Local\Temp\d9409cea8d58cb39ce2dc686ba3b36c3c2656f189529cbd7ef8d9ac7f1649d5cN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/2600-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

MD5 05851d196ce526905ef0284faee472e7
SHA1 ff6081966aaed189969fc2779bb986487d92d0e6
SHA256 462025be003f66648ed03bab68cfc54a6e7e6eb4eaffae4aab3741b3780f1368
SHA512 1a7d0d5c33aa809539e39b80e1be6a6668a89a68010939539a83f9cf40a0bc8a1b2ae541ac0e6279757186474f8a6df7ab59c750e79900a0e5e83c9021a36d5a

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 8ce90eb0567e7f4c92fd0b16d57c4052
SHA1 cb21cfcb8f468e76bf325d59d403b1d8bcecd721
SHA256 e9191589d55b7b4a8e2313556386f1a1ceb41270070308a8102b534ea04328ae
SHA512 c290c674ef30bd09f435b3528162b8ef9e6481dd09fafbb570b268b9784c9bc5dfb97a0b0a2bd24b687fefe3ff3d6fb8b651a63270e140c931fedd5c859136af

memory/2600-996-0x0000000000400000-0x000000000040A000-memory.dmp