Overview

overview

10

Static

static

3

2026-06-01...ry.exe

windows10-2004-x64

10

2026-06-01...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe
  • Size 11.7MB
  • Sample260601-3cstmaav2m
  • SHA256 dd287d317a2a867b2d25ffe6fd5bf428563442e6c003b5c6fba45750efb26d22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebootkitdefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 39 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 54 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 53 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3396
    • \??\c:\users\admin\appdata\local\temp\2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe 
      c:\users\admin\appdata\local\temp\2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\7zS369B.tmp\HPSupportSolutionsFramework.exe
        .\HPSupportSolutionsFramework.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Windows\system32\expand.exe
          "C:\Windows\system32\expand.exe" "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New.cab" "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New" -F:*
          4⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          PID:2244
        • C:\Windows\System32\msiexec.exe
          "C:\Windows\System32\msiexec.exe" /i "C:\Program Files (x86)\HP\HP Support Framework\HPSupportSolutionsFramework.msi" /l*v "C:\Users\Admin\AppData\Local\Temp\Framework_MSI_20260602-002239.txt"
          4⤵
          • Badlisted process makes network request
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4668
        • C:\Program Files (x86)\HP\HP Support Framework\Modules\HPSSFUpdater.exe
          "C:\Program Files (x86)\HP\HP Support Framework\Modules\HPSSFUpdater.exe" /f /n
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:1176
        • C:\Program Files (x86)\HP\HP Support Framework\Modules\HPSSFUpdater.exe
          "C:\Program Files (x86)\HP\HP Support Framework\Modules\HPSSFUpdater.exe" /t
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:4536
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3760
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visibility of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3252
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4416
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visibility of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3740
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3632
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FA9C2BB44615271D6E1DAB6C030B92D9 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4B8B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240667656 1 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.CheckIfNewerVersionInstalled
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3192
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4D80.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668031 5 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.CheckIfLatestHPSAInstalled
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4108
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668234 15 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.CheckHPSARunning
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1948
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3340
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7285AB0E0E4D46795734DE832AB5CFDD
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID481.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702656 2 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.WriteHPSSFRegistryEntries
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1756
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID55D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702812 12 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.GatherReportMetrics
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4660
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID5DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240702937 19 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.SetInstallReportMetrics
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2284
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID716.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240703250 28 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.RenameHealthCheckFolderForHPSA7
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1692
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSID7C2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240703421 32 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.InstallFusionService
          3⤵
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3220
          • C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\SysInfoCap.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\SysInfoCap.exe" -remove
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:788
          • C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\AppHelperCap.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\AppHelperCap.exe" -remove
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4080
          • C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\NetworkCap.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\NetworkCap.exe" -remove
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4040
          • C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\DiagsCap.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Enabling services - New\DiagsCap.exe" -remove
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4148
          • C:\Program Files\HP\HP Enabling Services\SysInfoCap.exe
            "C:\Program Files\HP\HP Enabling Services\SysInfoCap.exe" -install
            4⤵
            • Executes dropped EXE
            PID:2116
          • C:\Program Files\HP\HP Enabling Services\AppHelperCap.exe
            "C:\Program Files\HP\HP Enabling Services\AppHelperCap.exe" -install
            4⤵
            • Executes dropped EXE
            PID:2156
          • C:\Program Files\HP\HP Enabling Services\NetworkCap.exe
            "C:\Program Files\HP\HP Enabling Services\NetworkCap.exe" -install
            4⤵
            • Executes dropped EXE
            PID:2496
          • C:\Program Files\HP\HP Enabling Services\DiagsCap.exe
            "C:\Program Files\HP\HP Enabling Services\DiagsCap.exe" -install
            4⤵
            • Executes dropped EXE
            PID:1244
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI57B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715125 61 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.RestoreHealthCheckFolderForHPSA7
          3⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:3404
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI5E9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240715234 66 FrameworkCSharpCA!FrameworkCSharpCA.CustomActions.RegisterCustomProtocol
          3⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Program Files (x86)\HP\HP Support Framework\Modules\HPDIA.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Modules\HPDIA.exe" /Register
            4⤵
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:1980
          • C:\Program Files (x86)\HP\HP Support Framework\Modules\HPWPD.exe
            "C:\Program Files (x86)\HP\HP Support Framework\Modules\HPWPD.exe" /Register
            4⤵
            • Executes dropped EXE
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:3400
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1788
    • C:\Program Files\HP\HP Enabling Services\SysInfoCap.exe
      "C:\Program Files\HP\HP Enabling Services\SysInfoCap.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe
        "C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe" 0d6d004a-d29e-46ac-9611-7b014fc0ebf2 Global\78fab59e-ab1a-421d-bb38-89432be99de3 2024
        2⤵
        • Executes dropped EXE
        PID:5024
      • C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe
        "C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe" f625bd4f-0268-4961-aa14-26e3bd2c749e Global\1cd17bda-0102-4454-b0ac-dc98cf7a3026 2084
        2⤵
        • Executes dropped EXE
        PID:540
      • C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe
        "C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe" 9d414c47-9e9b-4738-82f0-556044c05e83 Global\efb09055-495d-40e4-acaf-c6df8931eb75 2084
        2⤵
        • Executes dropped EXE
        PID:936
    • C:\Program Files\HP\HP Enabling Services\AppHelperCap.exe
      "C:\Program Files\HP\HP Enabling Services\AppHelperCap.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:1984
    • C:\Program Files\HP\HP Enabling Services\NetworkCap.exe
      "C:\Program Files\HP\HP Enabling Services\NetworkCap.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:1600
    • C:\Program Files\HP\HP Enabling Services\DiagsCap.exe
      "C:\Program Files\HP\HP Enabling Services\DiagsCap.exe"
      1⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4460
    • C:\Windows\system32\wbem\unsecapp.exe
      C:\Windows\system32\wbem\unsecapp.exe -Embedding
      1⤵
        PID:1624

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58d369.rbs
            • Path C:\Config.Msi\e58d369.rbs
            • Size 286KB
            • SHA256 44a452e507b2639519eb3b1f3e99825aee94be7a42acbe46133ab2d423cae63f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            HPSupportSolutionsFramework.msi
            • Path C:\Program Files (x86)\HP\HP Support Framework\HPSupportSolutionsFramework.msi
            • Size 8.0MB
            • SHA256 b6b4d718cdf47d10719895203f8712c1fe4b44ec22365489861c55eb84aa27e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppHelperCap.exe
            • Path C:\Program Files\HP\HP Enabling Services\AppHelperCap.exe
            • Size 906KB
            • SHA256 aaab7b707c50f7272896ce40075f0014d5817f7ffeb83836978e047109049df2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BridgeCommunication.exe
            • Path C:\Program Files\HP\HP Enabling Services\BridgeCommunication.exe
            • Size 834KB
            • SHA256 d5ff5b2e9c21c81c584a966b535941bb76bb65b831fc409e5c41a0143c2fb68c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagsCap.exe
            • Path C:\Program Files\HP\HP Enabling Services\DiagsCap.exe
            • Size 905KB
            • SHA256 06630462d654558a9ad81716e385de477cb2ce01c7e14c0e4a997afad5db6345
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NetworkCap.exe
            • Path C:\Program Files\HP\HP Enabling Services\NetworkCap.exe
            • Size 900KB
            • SHA256 0f0ec6b7d9b8b3dabda93322377ebe51ea7ab129a7e0d44108aa42f304f7382b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SysInfoCap.exe
            • Path C:\Program Files\HP\HP Enabling Services\SysInfoCap.exe
            • Size 905KB
            • SHA256 eda56c313deb56332943bdd2c359e88a647b19bd752d88450c17b1992fe87202
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shared_store.dat
            • Path C:\ProgramData\HP\SharedServices\shared_store.dat
            • Size 416B
            • SHA256 a95fbe55193f5fc2c5fb13619e019e7499933786d9e3ee424e40068c06d542e3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            shared_store.dat
            • Path C:\ProgramData\HP\SharedServices\shared_store.dat
            • Size 512B
            • SHA256 fc0b4240edacb457ed293a767873aa9f9b92b1bab7ada6fd5084af2a1a4f274d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            shared_store.dat
            • Path C:\ProgramData\HP\SharedServices\shared_store.dat
            • Size 656B
            • SHA256 18a493b866c36934bc75673b532101d308e259f476fa58565181ef4f65d109f0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            shared_store.dat
            • Path C:\ProgramData\HP\SharedServices\shared_store.dat
            • Size 768B
            • SHA256 858016c99e33af2a781a3ae3c8d04600d9965183bfc1ef00ddb56f82e1d73d7b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Size 471B
            • SHA256 65362c5950270d1450c4ad1d3e020bee110c9e78161de2b9729d4146d3415c42
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_B31E28C755475D4406F4DCE74DA48B5E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B31E28C755475D4406F4DCE74DA48B5E
            • Size 727B
            • SHA256 06468ba4befc7e26aaf933856cec04ff35f347532cb9bcb64ffd8987aaf5de22
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 727B
            • SHA256 35bf435622e7fa5ad5f01fdb8052203fef880166d39cdbd513a1146ea87e3066
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
            • Size 400B
            • SHA256 47ac6b564c707d9c324d5be800d7b3a505151c10e3a13919530cfebb18b8fe83
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_B31E28C755475D4406F4DCE74DA48B5E
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B31E28C755475D4406F4DCE74DA48B5E
            • Size 404B
            • SHA256 20c21ca0ee887d70fefebb58eff1e2c121e942c1a07e526419115a94d7d83f39
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 412B
            • SHA256 5b09ad4d224e46c7121ea836304ff3c1f9e3cd8e5fce1c2cce8be05c2c5bdef6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            rundll32.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
            • Size 651B
            • SHA256 3c801df6bf214e7b7b80514241c3f6d0d250ddbefd8c3dcffc7402c2e755f970
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe 
            • Path C:\Users\Admin\AppData\Local\Temp\2026-06-01_181f436289a59de3e5ab22f6911ea03f_elex_hijackloader_swisyn_wannacry.exe 
            • Size 11.6MB
            • SHA256 1d80ae98533d9d46c323e0854eb334c047490c906aec9e14910cf9360a5bfcd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            HPSupportSolutionsFramework.exe
            • Path C:\Users\Admin\AppData\Local\Temp\7zS369B.tmp\HPSupportSolutionsFramework.exe
            • Size 17.5MB
            • SHA256 cf6ebed6d72208273c7a80942d6ecae99e52dcd1940117bc1f04a73f82afe207
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            HPSupportSolutionsFramework.exe.config
            • Path C:\Users\Admin\AppData\Local\Temp\7zS369B.tmp\HPSupportSolutionsFramework.exe.config
            • Size 309B
            • SHA256 c6d0ace656d3d1884ad9c98611af752f5437fa024f06f6c1f913558863188966
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Framework_MSI_20260602-002239.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Framework_MSI_20260602-002239.txt
            • Size 77KB
            • SHA256 ff1bdeabd99005a4479e0c056980f4893ad82013e44ec55ce5bc0837edb9329a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI4B8B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4B8B.tmp
            • Size 266KB
            • SHA256 6dd9fc5aa6ad196fc827e77c5389a259ad7fa1f0ed2047ca8040d041bad9f69b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FrameworkCSharpCA.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4B8B.tmp-\FrameworkCSharpCA.dll
            • Size 68KB
            • SHA256 39cd6f83ef99ff25309c84b0e6da995981ca2a74543a62cd5bb3ec0edd158d27
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Deployment.WindowsInstaller.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4B8B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
            • Size 179KB
            • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CustomAction.config
            • Path C:\Users\Admin\AppData\Local\Temp\MSI4D80.tmp-\CustomAction.config
            • Size 368B
            • SHA256 ebc7bcfdb1791915853158ade06e01215328afa158e7489d9bd92c620a50bf27
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            explorer.exe
            • Path C:\Windows\Resources\Themes\explorer.exe
            • Size 135KB
            • SHA256 55bc57b67ee1ce10846d79422b6fbd2458108dbc44854297847ce5b0a2e818f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icsys.icn.exe
            • Path C:\Windows\Resources\Themes\icsys.icn.exe
            • Size 135KB
            • SHA256 87eb2efec9135dc3413065ad082f68c97c68461736335ad413f73b41d6beb33d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            spoolsv.exe
            • Path C:\Windows\Resources\spoolsv.exe
            • Size 135KB
            • SHA256 db56f6e1808e0abd7c34e56c01fc117918c796ee8ddaedf94672c4b51917b493
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 24.6MB
            • SHA256 3d842ed68a68cd9de46dd08446d592bb79bb5ef73259b622b4bef0b53d8e394c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {b68838ef-0eee-413b-a853-ca64d127d3c3}_OnDiskSnapshotProp
            • Path \??\Volume{a40cd035-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b68838ef-0eee-413b-a853-ca64d127d3c3}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 83a26c1573569ee7e931faf7c4d5f6e9edac714d7b61edca75d0c260b4fd8b0a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            enabling services - new.cab
            • Path \??\c:\program files (x86)\hp\hp support framework\enabling services - new.cab
            • Size 8.8MB
            • SHA256 4bc3c439910e8d4207df6a6dc340ccc7aac21693ac56fbfb0dd692aa7fa343ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            svchost.exe
            • Path \??\c:\windows\resources\svchost.exe
            • Size 135KB
            • SHA256 99371f5e53f8e11ec7ca911cbc00b47626c4fa93f1ef3f2cc16628fa94487518
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1176-746-0x000001FEAB030000-0x000001FEAB04E000-memory.dmp
            Download

            memory/1176-744-0x000001FEA91E0000-0x000001FEA920E000-memory.dmp
            Download

            memory/1980-731-0x0000024198230000-0x0000024198388000-memory.dmp
            Download

            memory/1980-734-0x00000241B68D0000-0x00000241B6946000-memory.dmp
            Download

            memory/1980-733-0x00000241B6A20000-0x00000241B6BE2000-memory.dmp
            Download

            memory/1980-732-0x00000241B6D80000-0x00000241B72A8000-memory.dmp
            Download

            memory/3192-318-0x00000000023C0000-0x00000000023EE000-memory.dmp
            Download

            memory/3192-322-0x0000000002410000-0x0000000002426000-memory.dmp
            Download

            memory/3220-447-0x0000000005290000-0x00000000052B2000-memory.dmp
            Download

            memory/3252-812-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3396-0-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3396-56-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3400-736-0x000001A042460000-0x000001A0424AE000-memory.dmp
            Download

            memory/3616-53-0x0000021E79F70000-0x0000021E7B0E8000-memory.dmp
            Download

            memory/3632-54-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3632-52-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3740-813-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3760-57-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/3760-16-0x0000000000400000-0x000000000041F000-memory.dmp
            Download

            memory/4416-55-0x0000000000400000-0x000000000041F000-memory.dmp
            Download