Malware Analysis Report

2025-08-11 01:48

Sample ID 241005-x5ngqazeqr
Target f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN
SHA256 f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5b
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5b

Threat Level: Likely malicious

The file f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (1767) files with added filename extension

Renames multiple (457) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:26

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:26

Reported

2024-10-05 19:28

Platform

win7-20240903-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe"

Signatures

Renames multiple (457) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\OmdBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\wab32res.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Internet Explorer\msdbg2.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\rtstreamsink.ax.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe

"C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe"

Network

N/A

Files

memory/2096-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

MD5 644c2ffa6adb03e1c90531aed3deb248
SHA1 71178ec58ab7443f35b1caa620165603613176a3
SHA256 fa87f8c3103335d7d8ddfc46fc74988bf6640d7e5a036fe36208f363293d3832
SHA512 78a3af93c96d0789586020135d91526bbcd35a020e490a10caa6e59d12f3c2af7da3fc2df540e6a8c17b3f057b6f6d6663f92b24df9b9d8c03d5b06bd5b6e902

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 c9b6a439151c0959d8866ab1a0b7b2d0
SHA1 e6208aef02e4ff7c09714e59bbd24292b9e22cbd
SHA256 e065b6b3663a9b1c942cdd9fc3bf7450a2d01bd0b8b83a32a12c8d8e7797eb9a
SHA512 1737149ec62a2d81d19865cc4ff0014f3565ba316790ffc7f4f54a686d9caf32bc76e61452587fe588d38f74dc71fe3fe4801a827ecc469a8c85d89d6591d96c

memory/2096-62-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:26

Reported

2024-10-05 19:28

Platform

win10v2004-20240802-en

Max time kernel

120s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe"

Signatures

Renames multiple (1767) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe

"C:\Users\Admin\AppData\Local\Temp\f14e8179ce0817ff2cbf2ae1ee4cc7785a159cbfc1555e057f70f9c88ac62b5bN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/5032-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

MD5 fb8c92126cc540132aa9298410c463e0
SHA1 c1036c383e257483797ce72af5530ae0ca43f3ec
SHA256 cade133bb31a8f629d2baaeed39be952677d7184575347811a1cf5a43bbe90db
SHA512 a4cfd56f522d565c056998189a652aa0e30ac2fdaa089b0a9324dd201f9e5c3853d6633f30f6a11faf03c1f06b533e044d31924f5a22c9d7ea0fb7a6d8f1bae3

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 2f090d525af2f29cd1838cd321abec53
SHA1 caa559304c3b9c9c99c88bb60502603df735fe20
SHA256 ae4c9c91c4e3e7b2107f27b486f1f967e87f7f196ecac0e75b1f0db3fc6ef2d7
SHA512 9689ccd18196e6639b002a391f3af0b0c9a3d561a7b852c716ac86a718d855521edc1cd71aacb9cec52b13e4aec04214acd7fd75b81d0fc97a134a4c0bc414fa

memory/5032-392-0x0000000000400000-0x000000000040B000-memory.dmp