Malware Analysis Report

2025-08-05 21:56

Sample ID 241006-k1y2fa1bre
Target db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N
SHA256 db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006

Threat Level: Likely malicious

The file db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (1242) files with added filename extension

Renames multiple (5274) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 09:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 09:04

Reported

2024-10-06 09:07

Platform

win7-20240903-en

Max time kernel

150s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Signatures

Renames multiple (1242) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\BackupBlock.potm.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Network

N/A

Files

memory/2176-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

MD5 24e61457af9832b1d6fba47c1cccbcda
SHA1 b6774297d35ac159b38bbd8cb1bcf9af4428717d
SHA256 394860fb236ab8c50f26ef882eb54254ed2ab17f24b967ac62dcc964395c370d
SHA512 1ac4a8a34bb184dc6ba44e1e0c0a18d08eebd650c2ae76c9fa18a5d578cc39a06d74203025d8e02ea97435c5e6684891e14d3511c0871837473c45bec02f63ca

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 24cc58a82f6252dbe6a74542c97b478d
SHA1 0331a5f53b33f64a55f068551da34e2793bbbc0f
SHA256 512009021a46f1c6b2ec6df7e058fcd65a74ed419334182c611b212f0e1e0016
SHA512 751e26f181a164b295e3b2b87384a44523dcd382b0d50df08210c2f4b4080cdc9d11bd96e7a78720b817fec5c7d9a86c0087d508aba614edf335c7ef26be7783

memory/2176-26-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 09:04

Reported

2024-10-06 09:07

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Signatures

Renames multiple (5274) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe

"C:\Users\Admin\AppData\Local\Temp\db7776ee85efc598ae157ee403ca5e204fb3482e93520f508aef56e18fdf2006N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/3280-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

MD5 a5b1d4a91152d0aab31844219e715b19
SHA1 de3db2b23f22a0f95b7dc38fdde1690613b079ba
SHA256 68497cca92126b39533e05b95f65fa9b5eba384f59b7c1d514e43510678b3ef1
SHA512 00a86c2014466a5ae297d375516d570ec0769e10ce8b80b727ff58195890c2d809cda0e8bc17b82bed05dedbd9e1b37fa9d99df27b149f31de2e691c39d9f850

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 cbbd630e5cf592cba1a76b54472bf732
SHA1 e08239bce81939783d2c580dbab772167f7a331b
SHA256 e99fe4135495c1c104f305fa17a493a038d247f43f85ea8c026f98181b607abd
SHA512 02647674aaddff34a5c55b0ed911b0aa406127df9980c8a89c1cf48f650f9494229ea3baae41d2e4fdd354afef4670f95cbdfbad009b958dad8d166acf9873ff

memory/3280-967-0x0000000000400000-0x0000000000408000-memory.dmp