Malware Analysis Report

2025-03-15 08:28

Sample ID 241020-vftlbsygjg
Target c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN
SHA256 c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbc
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbc

Threat Level: Likely malicious

The file c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (3277) files with added filename extension

Renames multiple (4642) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 16:56

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 16:56

Reported

2024-10-20 16:58

Platform

win7-20240729-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe"

Signatures

Renames multiple (3277) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\7-Zip\Lang\ne.txt.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\InitializeApprove.emz.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Mozilla Firefox\precomplete.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe

"C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe"

Network

N/A

Files

memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

MD5 a04911e8a1fca0a788d8d772940f5e40
SHA1 09662f23533111d5793d2c1742f043e667180d47
SHA256 c0ec13826dfc907adfeb6a73a50926619c1bb99c0a85b56ed0f27160f9681e3b
SHA512 a9b164ed7974229cb14e995c390e3a4042119655d1704094a737d7e75883a39f5186935ea89fd576af4d8de5c95a19bb323c15fd1db2988047719f40e1b67ded

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 4d78514a5307bafc80d18b3790983190
SHA1 d6920199ea90c11fc1665e9eab6dd1238f2f0020
SHA256 56b3fd6a198aa8b6475ce37c1c880ef9d891b94b4aa122b3548471e89762a807
SHA512 aa3121097720a2247b5298f8c59d2ff43dbae3407b7f29b92d1a9e419dad3b08932dded8237e6f8a12f134d89cb16f56da8016fc4e6a4adf3c1e7bd11447f669

memory/2188-68-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 16:56

Reported

2024-10-20 16:58

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

104s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe"

Signatures

Renames multiple (4642) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe

"C:\Users\Admin\AppData\Local\Temp\c9cdf17924b478c958c1451c721dd9f9dd89f1c0d90ceb4be73785b8f4331dbcN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/4760-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 0361b26b9a636708ef892044ae951091
SHA1 f66962ce463393d4d58b51decd7a7f94bcabe247
SHA256 f0fbe7c9782bcb9b94317f5514dd2dd8e96173af78900936eacf811efffe84aa
SHA512 3ba424c3b019a11636324e43696a259dd30834f6932aedf3bdee9d66d79c543a607493eb74a8d0c8053b28739664ea587b4553ec5c5ad35d3b5da6401560776d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 2f350a245559f420db6dcae726e527ef
SHA1 408884d88318301c2c450ef3c80c221648e576cf
SHA256 6c03f13006a1fbd230a5a1a8ee5787bb5d50c994c2682c898edf59cc262f49b2
SHA512 ac3dac9d90ca8ec44fc2b5931b988a0beac0f1347afc8e098fcb3aa3883c7943e57c084f0d365f405107b60bca9cb027bd89b8b0153e12de52c56f64b100c251

memory/4760-658-0x0000000000400000-0x000000000040B000-memory.dmp