Malware Analysis Report

2025-08-05 21:56

Sample ID 241006-kzh9lawgqm
Target db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N
SHA256 db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006

Threat Level: Likely malicious

The file db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (3375) files with added filename extension

Renames multiple (4646) files with added filename extension

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 09:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 09:02

Reported

2024-10-06 09:04

Platform

win7-20240903-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Signatures

Renames multiple (3375) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\uk.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Network

N/A

Files

memory/2692-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

MD5 0e6a5be36a45b0069a9c636e6b701954
SHA1 a4ab486a22df760eb8e1f097c49ef110d7c80173
SHA256 15c4a6324dd6c6256c1aa0a342f3d58b7c0e74c39816f44fe83165e6d1e2c21e
SHA512 1c9b80fb29fe8eabbf80616b6106117927e22c3ae1b486b7f6ae263bac5810e9cbbe7af10b180df2122df1550ef52cd9626dfd0af381823e90f0d030a00008df

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 bf69e0f6d837d39cbba5dc3cf0dc4c97
SHA1 85ac6b3adb3a87af199a33164ab60e3b9126cfc5
SHA256 7d7fed1b2352d034e96b139161b4738a9e6f10f3ac1df362b2e3156cbe93dc58
SHA512 9407837ce5e1250ca60db86d447f71daa96ab1f59acc1a731a1e7daea827bc5b360be24f46c3009a25c3d77130d6e8999c1bd10458147bcab408e76ad5afdd60

memory/2692-74-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 09:02

Reported

2024-10-06 09:04

Platform

win10v2004-20240802-en

Max time kernel

119s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Signatures

Renames multiple (4646) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\te.pak.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/2268-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

MD5 2a180686b88657ad7ef86fa177dda789
SHA1 ea65e9a610302a1e96bb5f47c733a7cc6a33e496
SHA256 415c0feb90d0d16ffcbdc14503056a18b1bf45e1072b1e739262b2436638b43d
SHA512 7d5bd69b0991d98d188b41d846bbb551f889fc60a8065868c23669102ca4413d346cd2bf7adaa5a79356011d72728dd1745962c265f8ca7a76cfe214a0bd8da3

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 44211e2e1318ad5eca5689a6a387f0b3
SHA1 acb87a2ecb2edec47744ea3e066977cf4e45deff
SHA256 b943e7ae46f310466b7938726a77303fbad5057f1fdf9d7c9f11e40a6a0f92f1
SHA512 9de0152fa16c1b190253f6c7945e829b6180b526b76a25dc5c19073775255d0b3081d9a0c1ff1125d3dd28f8c974b031d49f39e94d3d1020251314c3c79bbe7e

memory/2268-956-0x0000000000400000-0x0000000000408000-memory.dmp