Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-ytmaysyqhp
Target 72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e
SHA256 72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e

Threat Level: Known bad

The file 72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (219) files with added filename extension

Renames multiple (130) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 20:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 20:04

Reported

2024-12-27 20:05

Platform

win7-20240903-en

Max time kernel

60s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Renames multiple (130) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\gu.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ga.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hr.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ba.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft COM+ Services Meta Data" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%systemroot%\\SysWow64\\clbcatq.dll" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

"C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe"

Network

N/A

Files

memory/2504-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2504-1-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2504-8-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2504-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2504-13-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2504-12-0x0000000000400000-0x0000000000616000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

MD5 78d2ab53be41a02e08465fd960cfc88b
SHA1 c25bc4092da1361136066459f5fb5684f94d3cf4
SHA256 01a8f6073edfaf2a7f3aa9193023b5e35de928e3a2388c747b49e327532313f9
SHA512 f651406694ee31b0b34f82a6fa0f22f8f3b8d1df0feb7b929a98b74f28b8f60712827a66617c737e00d1e06c343f6974d5c7cf61bb472ca960ad8ad3e62a9b08

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 27478d2c0d8d0d3dcd245bad19a31af5
SHA1 d724129bc8ce5ddd51aa19817ac49d2cd3520dbe
SHA256 1fdb14b2ffb05ae0ac2082b6190af0bd4954a5233487739137623cb9a7c58b6a
SHA512 ce11f00ba9f05ca57c755dae9a57d9d5ceafce891c9436c4dc2fe42e902f5f354066b7c65f77a0b42130bb20e2fa6e34916aef7c902f39b99f3582333702a0ca

memory/2504-26-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2504-25-0x0000000003040000-0x000000000324C000-memory.dmp

memory/2504-37-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2504-43-0x0000000003040000-0x000000000324C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 20:04

Reported

2024-12-27 20:05

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

37s

Command Line

"C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Renames multiple (219) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\sa.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\cs.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\kab.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\7-Zip\Lang\et.txt.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Elevation C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "EditionUpgradeHelperObj.EditionUpgradeHelper.1" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{6F65B602-F798-4094-8A41-A2A61961E5E8}" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Programmable C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "EditionUpgradeHelperObj.EditionUpgradeHelper" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalizedString = "@%SystemRoot%\\System32\\EditionUpgradeHelper.dll,-3100" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Elevation\Enabled = "1" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "EditionUpgradeHelper Class" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\EditionUpgradeHelper.dll" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{09C6A793-92DC-4D27-A11D-3921C9314DED}" C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

"C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp

Files

memory/952-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/952-2-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/952-9-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/952-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/952-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/952-14-0x0000000004970000-0x0000000004B7C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 d6b2efe177675b9c3320fe8cdec21361
SHA1 dbfafdd6190246beb447c02867049af1f41fcd47
SHA256 2dc0a65bad1806b0c7a887715ba8995077cf9e24af0d8ec516be85a97d444fe2
SHA512 ad5391686aa42507701b13802f66d45d457b05764ac5578779ef524680cf39edb7a020f42a106f31b2d802bf2ec3cde0d6199835f52abce8c4c243a084a1db3d

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 00bffaf6b2816719362221cfbc4ef2be
SHA1 f76c408704e6cad9fe9dac702f3bd61a9d4a824e
SHA256 518806d3e6389d4dd031480187ea8bd0e348731b08acfbbf3f4bd58939a64dcc
SHA512 ca2cd2092563959da64bb361863af395b1d09043ba9c77fbf495dd84eac50aae6bd944259e6555d9e70ddf22e5c26baf85c823e3296cb15a6300df4b45d328b5

memory/952-36-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/952-37-0x0000000004970000-0x0000000004B7C000-memory.dmp

memory/952-80-0x0000000000400000-0x0000000000616000-memory.dmp

memory/952-92-0x0000000004970000-0x0000000004B7C000-memory.dmp