Malware Analysis Report

2025-01-03 08:32

Sample ID 240611-adkkeswcrg
Target 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29
SHA256 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29

Threat Level: Likely malicious

The file 834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (3500) files with added filename extension

Renames multiple (5200) files with added filename extension

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 00:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 00:05

Reported

2024-06-11 00:08

Platform

win7-20240215-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe"

Signatures

Renames multiple (3500) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\content-types.properties.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Mail\msoe.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Mozilla Firefox\locale.ini.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe

"C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

MD5 191507a30c2d8a7eecdc8c5a947308da
SHA1 158ea8d0997517879324e9161a5c43125be16367
SHA256 5aee58bdaaa33bec610faad5ffc415a3df0401a3a7ea8d3bdbbfef7c5233bc34
SHA512 7f43df5aab322a251f190642bf4f641ed1626758303100cd7c0306d2151df77716e4f9510852e290f21c15899c63eb2f056f676f6d1a23ccb5db1a709de813a0

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 0ea3d85dfa933aff4dc0fafbc725b089
SHA1 137619c9425512a519392fa5f8b30c65a4a05610
SHA256 b600973d9f9d3c9b22426c0910876a901108cbbc5f95836c1714dded034ced9c
SHA512 344758b020210d4a97f55a745ddb28b343a457f54988e893e119276fd2950898cc14076a8dfc74ed82255b54dbdc418e20a7ecb43385792d3132fd0f76cf769c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 00:05

Reported

2024-06-11 00:08

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe"

Signatures

Renames multiple (5200) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.TLB.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\ConvertToRestart.vdx.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe

"C:\Users\Admin\AppData\Local\Temp\834e747d112c36d6d7fa2d49792534b0a4f4078c1a69905e8e82a1a557f2cc29.exe"

Network

Files

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

MD5 be3d8129d1d74244139fc397f1b282bf
SHA1 6b3e72039f7ad41b908925ac731e27f5821997e0
SHA256 09da2edbeca02b4202f61f7ac2286111729158a1d27d177c52aa99d4bbb37d46
SHA512 6d7187421378fd5e1e2f15f7649a7e35aafe2c565e6345ffc4f2b2dd3c70495881f8a21ee47f9f2b41114a80c9ab919851d1a7f6292a9a8cfa33d6ab755d363a

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 ccd17543f8be6dc24118a07156c422e6
SHA1 4a3701f409a2585d45b0aecf5f08ddf74e1a95b2
SHA256 8e8c36336833b703e746c10fb1ce17d6abf3af3fc9879e3e524218f5e895f6c4
SHA512 7513182e16ac8171405a6f83a181f93218ece022c0bedd3f72d8b981f077b1a97fe55a8e913aec1da6da67617683e4ef75d04f2671f3d4ff405e5587df8e7417