Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-yk2z2symcy
Target 99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
SHA256 99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b

Threat Level: Known bad

The file 99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (142) files with added filename extension

Renames multiple (218) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:51

Reported

2024-12-27 19:52

Platform

win7-20240903-en

Max time kernel

60s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Renames multiple (142) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "System Monitor Source Properties" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sysmon.ocx" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe

"C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe"

Network

N/A

Files

memory/2532-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2532-1-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2532-8-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2532-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2532-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2532-13-0x0000000003030000-0x000000000323C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

MD5 3be79f5670535b2b80be67c01973447f
SHA1 6c327c6c35294e2ed457be4d02d0bd422ef9becb
SHA256 cd9016222805ba306748dd4b87c478b1bf58bcae15cc1aad5692f97fc2cb586d
SHA512 4adb9a8ae4a2d62b2e48ad799bf1effe452f33214678fe47ceda848b0adb870fdc0b87aea291ac91055611c39924cdd4d70bd19814304b54bc3b12e5bce6f040

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 144de9e67e0eca7b3939bbc680463b92
SHA1 976a6a072b3e9549703e499bc89d207e3ef3ad03
SHA256 0c44c92bed434725dcddf8363bb08bb00036489c5497e02576769f19435c0a06
SHA512 4a45616f4a20b390508efc0fb1502e29a59223e8701a8e5915eb37db8e1626ea5b3d00695c6959737bd4a2112546616c88da37358be9a85db512707e7e7d28fc

memory/2532-26-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2532-25-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2532-41-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2532-45-0x0000000003030000-0x000000000323C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:51

Reported

2024-12-27 19:52

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

38s

Command Line

"C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Renames multiple (218) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "CLSID_POSyncServices" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ = "%SystemRoot%\\SysWow64\\Pimstore.dll" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InProcServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "PocketOutlook.Application" C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe

"C:\Users\Admin\AppData\Local\Temp\99720d4692de6ffc03f6f71713accf903387729e685dfd091d92c6e8605c485b.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp

Files

memory/1548-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1548-2-0x0000000004370000-0x000000000457C000-memory.dmp

memory/1548-9-0x0000000004370000-0x000000000457C000-memory.dmp

memory/1548-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1548-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1548-14-0x0000000004370000-0x000000000457C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

MD5 024a7c317b6f40c42ddd32274e198d05
SHA1 f2543397f307bf7de77ff14129fcd6e604b8361a
SHA256 667245faaac0e5002ef00b904f1cb7fb44b9857422a0fc29c64555d85463405e
SHA512 cd07a9647f9eb823c623202a3bb75af4f765033b068aa97975eec31444b1749d5fb6ac4273552ee4884d69be6511690f7804e938cdfd61011fc44ed17003c3a1

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 37e12dbb1957a5abec6ac46d827aa361
SHA1 58ab339117d163e43d7d1a38318ff42db84031c8
SHA256 01700a90659806e612eb28534a410bb7945a6830e6276a3c0508c76f84241cf2
SHA512 48cb215403ba66527d6cf1df30c5816972bf623a0e32bffebd17dc64adca147fb1a1ff460eb988e1ba3be7cee4e59360f62958d72d513f6f0f353d0b59233569

memory/1548-34-0x0000000004370000-0x000000000457C000-memory.dmp

memory/1548-35-0x0000000004370000-0x000000000457C000-memory.dmp

memory/1548-90-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1548-102-0x0000000004370000-0x000000000457C000-memory.dmp