Malware Analysis Report

2025-08-10 20:10

Sample ID 250518-lyny5azlw6
Target c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66
SHA256 c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66

Threat Level: Likely malicious

The file c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (223) files with added filename extension

Renames multiple (222) files with added filename extension

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-18 09:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-18 09:56

Reported

2025-05-18 09:59

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"

Signatures

Renames multiple (223) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\es.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\7zG.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\dicjp.bin.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\tk.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\readme.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe

"C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"

Network

Country Destination Domain Proto
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp

Files

C:\$Recycle.Bin\S-1-5-21-3674642747-2260306818-3009887879-1000\desktop.ini.tmp

MD5 76936e288c0c15c07d40fad7b659aa33
SHA1 21b13889850862238a05b04c75b768d558efc530
SHA256 aa0f7b4a20f701666b9042c9b7f78f33635fb837c7a24a966b863891327945f5
SHA512 9fffe9e237ca1316a09fdf9d93ecff6c15f3cf81057987403ce42a462003f64edc5f771c1d7bcbf2ecb4a247d16064498b68a2fb18e0f579a943330980d0f94e

C:\967f022c4c136664abfad56c1fb73a\2010_x86.log.html.tmp

MD5 aec846fa971d15d5c247840edcc27699
SHA1 8a730aef730767406f9d09a49eb3830211b7064e
SHA256 69d67efb54e4b239fa9291569ee92df24deb147e572b50ab24d3d7a8410a7ec2
SHA512 cd1a7a52c5c3ab7e421933cfd4e7666d37b2fb96001c957fb7fb690c46a305c138b3a5f9555487313d2af3bc4622445743560decee4c6ce75c9c08a65d469274

memory/5280-43-0x0000000000400000-0x0000000000407000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-18 09:56

Reported

2025-05-18 09:59

Platform

win11-20250502-en

Max time kernel

150s

Max time network

111s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"

Signatures

Renames multiple (222) files with added filename extension

ransomware

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\lij.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\License.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\BlockGrant.wdp.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\descript.ion.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe

"C:\Users\Admin\AppData\Local\Temp\c02f9f14ff3044ba255b9d1877dba3340d954261b08a8bf48687149a1ce6bb66.exe"

Network

Country Destination Domain Proto
IE 52.111.236.23:443 tcp

Files

C:\$Recycle.Bin\S-1-5-21-3588213599-686740421-4058676312-1000\desktop.ini.tmp

MD5 89233fb47b986b7faa8d6cf07213aa90
SHA1 4eb9e65ba2a30137178309d5c837797bea3e7ab6
SHA256 6c635a286d4f79c21ba06e3d99f52023d94718977835685d99fe45a9cf15f12b
SHA512 13c9ae4483027a0ef0f1dbfc8ea3a2bb9623aaa2097bca544a95c3684077f61444ceb32c64793079c3cef87c0da6f77d1d72f903d723ffc62ba49099896f5122

C:\ef2ee615ae93a516ddfc423cbf0f901a\2010_x86.log.html.tmp

MD5 575f363ed8a134c19007ecc2a1568716
SHA1 1a3d0acf955681386f6ca179383f1029128e1917
SHA256 8874cd760ed3b93b2ef233e5dadc7b7304a3e86ef3407d918087ee1551d51bf9
SHA512 fc1562d8430ce8e88d699357b20d21330d10489a6f1d9abe376537a38946568eec88cf1c253ed22e7f9e2e732dbbea912cf157e1f1b853c9e634ea7662656b52

memory/1176-43-0x0000000000400000-0x0000000000407000-memory.dmp