83b01be70c83680099dce399f7bf300027d6c464c1a94bc5995713059b24c115

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe
Size 7.9MB
Sample260718-jfcf9scv4m
SHA256 83b01be70c83680099dce399f7bf300027d6c464c1a94bc5995713059b24c115
MD5 72bc0ea96b527fa5aa63769bc113e531
SHA1 a1807a92e1c24bb893abf6410d194382b6c82ce3
SHA512 d1ad8466658f107b683bb6367d5dd9e4b68463df46732451a9201c120b694721e8a00a44b69a71e9cd78433c65b43b36eb4e7c40d698b93559bcc132a1c783bc
SSDEEP 196608:uWx5KxGkaNk4LdYDdA5tsOmPPtQ8M/3mFTicHZw:uWxO4GDdA4bPPtQ8MOY0w
TLSH
T1A086121376C1C03FE1B208728C6F9EB842A17D675A30495B7594FE2C2EF4592B927F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1232	netsh.exe
6124	netsh.exe
5380	netsh.exe
5936	netsh.exe

Executes dropped EXE 5 IoCs

pid	Process
5480	ISBEW64.exe
5524	ISBEW64.exe
4420	ISBEW64.exe
3632	ISBEW64.exe
1116	ISBEW64.exe

Loads dropped DLL 26 IoCs

pid	Process
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe
4640	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\comcat.dll	MSIEXEC.EXE
File opened for modification	C:\Windows\SysWOW64\stdole2.tlb	MSIEXEC.EXE
File created	C:\Windows\SysWOW64\DicomPM.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\Kodak KFC Language.vc6{i3r4}.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\comcat.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.dll	msiexec.exe
File created	C:\Windows\SysWOW64\DicomPMUI.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\Communication.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\spool\drivers\w32x86\3\EKdicom_gdi_20.dll	msiexec.exe
File created	C:\Windows\SysWOW64\QueryRetService.vc6{i14r3}.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc42u.dll	MSIEXEC.EXE
File opened for modification	C:\Windows\SysWOW64\olepro32.dll	MSIEXEC.EXE
File opened for modification	C:\Windows\SysWOW64\mfc42u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\olepro32.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Dlugosz Repertoire Ratwin.vc6{pb6+6}.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp60.dll	MSIEXEC.EXE
File opened for modification	C:\Windows\SysWOW64\asycfilt.dll	MSIEXEC.EXE
File created	C:\Windows\SysWOW64\Dlugosz Repertoire Classics.vc6{pb6+6}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\element.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\DICOMInterface.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\DicomPrinterDriverEventLogMsg.dll	msiexec.exe
File created	C:\Windows\SysWOW64\BridgeToKDT.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\asycfilt.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\oleaut32.dll	MSIEXEC.EXE
File created	C:\Windows\SysWOW64\coding.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\PrintService.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Kodak KFC Types.vc6{i3r4}.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcrt.dll	MSIEXEC.EXE
File opened for modification	C:\Windows\SysWOW64\stdole2.tlb	msiexec.exe
File created	C:\Windows\SysWOW64\acse.vc6{i14r3}.dll	msiexec.exe
File created	C:\Windows\SysWOW64\types.vc6{i14r3}.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp60.dll	msiexec.exe

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_2000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_rc.gpd	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8500_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_20.INI	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_KELP_2180_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_6800_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\SONY_DF550C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOM Printer Driver User Manual.doc	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_rc_20.gpd	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\KONICA_771C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_5700_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_LR5200C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\CODONICS_HORIZC_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_FMDPLC_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_1000_3000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOM Printer Driver.chm	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8300_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8150_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8600_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\KONICA_752C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5300C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8100_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5500C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_OUTPUT_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_7000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8700_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_PRIMA_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_CHROMA_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOMStatusMonitor.exe	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_KELP_1120_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\ekdicom.cat	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_3000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_AXYS_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\CODONICS_1660MC_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_MEDIA_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM.INF	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AddDicomPrinter.exe	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_ui_20.dll	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\SONY_DF500C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_4000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8900_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_gdi_20.dll	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\KONICA_832C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_CMI_1000_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_5800_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8610_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_COMMON_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_KELI_160_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_4500C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\FUJI_5000C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_6850_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DicomPM.DLL	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\BridgeToKDT.dll	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_8200_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_PAPERS_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\SC_2M_AT_OREX_IMCS_401U_9.4.1.40-03.bin.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_gpd_20.dll	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_5850_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5302C_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EK_DRYVIEW_CHROMA_PAPER_BW_20.GPD	msiexec.exe
File created	C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\KONICA_793C_20.GPD	msiexec.exe

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_CPPRT60_f0.51D569E3_8A28_11D2_B962_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\e59c4dd.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F1F9A2E6299C243.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAEF.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\e59c4df.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A4BD845656ACC40.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59c4dd.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\NewShortcut2_B91CA22BF46D4A4B905579C45717B217.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_MFC42UnicodeCore_f0.7EBEDD6A_AA66_11D2_B980_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_CPPRT60_f0.51D569E3_8A28_11D2_B962_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\NewShortcut1_62192470B18E40F9A2169A7B3C1DDCC6.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\NewShortcut1_62192470B18E40F9A2169A7B3C1DDCC6.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7B087F6AA523AAC2.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\Installer\SourceHash{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24	msiexec.exe
File created	C:\Windows\SystemTemp\~DF35A4AD680F9F016C.TMP	msiexec.exe
File created	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\ARPPRODUCTICON.exe	msiexec.exe
File created	C:\Windows\Installer\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\NewShortcut2_B91CA22BF46D4A4B905579C45717B217.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\707CCA3750BD2E040A84B17AAFEFAFEC\2.0.0\Global_VC_MFC42UnicodeCore_f0.7EBEDD6A_AA66_11D2_B980_006097C4DE24	msiexec.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}\409 = "Controls"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{40FC6ED9-2438-11CF-A3DB-080036F12502}\409 = "_Printable Objects"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\ProductName = "DICOM Printer Driver"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3030C056E44CFF64E9042A5BF35D64F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories\{40FC6ED3-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\707CCA3750BD2E040A84B17AAFEFAFEC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3030C056E44CFF64E9042A5BF35D64F9\707CCA3750BD2E040A84B17AAFEFAFEC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\PackageName = "DICOM Printer Driver.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{40FC6ED8-2438-11CF-A3DB-080036F12502}\409 = "Document Objects"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\707CCA3750BD2E040A84B17AAFEFAFEC\NewFeature1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories\{40FC6ED8-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories\{40FC6ED9-2438-11CF-A3DB-080036F12502}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\PackageCode = "70C5246EDBC27BA4F828A8B56F6D8657"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\ProductIcon = "C:\\Windows\\Installer\\{73ACC707-DB05-40E2-A048-1BA7FAFEFACE}\\ARPPRODUCTICON.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\SourceList\Media\1 = "DISK1;1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{40FC6ED3-2438-11CF-A3DB-080036F12502}\409 = "Embeddable Objects"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Component Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}\409 = "Automation Objects"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\Version = "33554432"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\707CCA3750BD2E040A84B17AAFEFAFEC\InstanceType = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5888	msiexec.exe
5888	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3456	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3456	MSIEXEC.EXE
Token: SeSecurityPrivilege	5888	msiexec.exe
Token: SeCreateTokenPrivilege	3456	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3456	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3456	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3456	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	3456	MSIEXEC.EXE
Token: SeTcbPrivilege	3456	MSIEXEC.EXE
Token: SeSecurityPrivilege	3456	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	3456	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	3456	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	3456	MSIEXEC.EXE
Token: SeSystemtimePrivilege	3456	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	3456	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	3456	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	3456	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	3456	MSIEXEC.EXE
Token: SeBackupPrivilege	3456	MSIEXEC.EXE
Token: SeRestorePrivilege	3456	MSIEXEC.EXE
Token: SeShutdownPrivilege	3456	MSIEXEC.EXE
Token: SeDebugPrivilege	3456	MSIEXEC.EXE
Token: SeAuditPrivilege	3456	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	3456	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	3456	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	3456	MSIEXEC.EXE
Token: SeUndockPrivilege	3456	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	3456	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	3456	MSIEXEC.EXE
Token: SeManageVolumePrivilege	3456	MSIEXEC.EXE
Token: SeImpersonatePrivilege	3456	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	3456	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	3456	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3456	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3456	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	3456	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	3456	MSIEXEC.EXE
Token: SeTcbPrivilege	3456	MSIEXEC.EXE
Token: SeSecurityPrivilege	3456	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	3456	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	3456	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	3456	MSIEXEC.EXE
Token: SeSystemtimePrivilege	3456	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	3456	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	3456	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	3456	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	3456	MSIEXEC.EXE
Token: SeBackupPrivilege	3456	MSIEXEC.EXE
Token: SeRestorePrivilege	3456	MSIEXEC.EXE
Token: SeShutdownPrivilege	3456	MSIEXEC.EXE
Token: SeDebugPrivilege	3456	MSIEXEC.EXE
Token: SeAuditPrivilege	3456	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	3456	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	3456	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	3456	MSIEXEC.EXE
Token: SeUndockPrivilege	3456	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	3456	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	3456	MSIEXEC.EXE
Token: SeManageVolumePrivilege	3456	MSIEXEC.EXE
Token: SeImpersonatePrivilege	3456	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	3456	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	3456	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	3456	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	3456	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3456	MSIEXEC.EXE
3456	MSIEXEC.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3456	MSIEXEC.EXE
5888	msiexec.exe
4640	MsiExec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 3456	6016	2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe	89
PID 5888 wrote to memory of 4640	5888	msiexec.exe	91
PID 4640 wrote to memory of 5480	4640	MsiExec.exe	93
PID 5888 wrote to memory of 2880	5888	msiexec.exe	100
PID 4640 wrote to memory of 5524	4640	MsiExec.exe	103
PID 4640 wrote to memory of 4420	4640	MsiExec.exe	106
PID 4640 wrote to memory of 3632	4640	MsiExec.exe	107
PID 4640 wrote to memory of 1116	4640	MsiExec.exe	108
PID 4640 wrote to memory of 1232	4640	MsiExec.exe	109
PID 4640 wrote to memory of 6124	4640	MsiExec.exe	111
PID 4640 wrote to memory of 5380	4640	MsiExec.exe	113
PID 4640 wrote to memory of 5936	4640	MsiExec.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\DICOM Printer Driver.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-07-18_72bc0ea96b527fa5aa63769bc113e531_elex_stealc_stop.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3456

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 453B9315290B86AE4D7E4A4D3A7905C7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95CA8F62-B1DA-4D9A-A90F-E81AD67BD770}
    3⤵
    - Executes dropped EXE
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{55EC088E-1B9A-4088-8524-26FC2AC905FC}
    3⤵
    - Executes dropped EXE
    PID:5524
- - C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{600E30AD-3864-4B06-B689-D0D5D2EB70E2}
    3⤵
    - Executes dropped EXE
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CA00888-475A-4276-B182-4911945E8275}
    3⤵
    - Executes dropped EXE
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
    C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D9A4BCA8-29D2-40B5-AE5E-8A806B8DEB09}
    3⤵
    - Executes dropped EXE
    PID:1116
- - C:\Windows\SysWOW64\netsh.exe
    netsh.exe advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Add DicomPrinterDriver program="C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AddDicomPrinter.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Windows\SysWOW64\netsh.exe
    netsh.exe advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Add DicomPrinterDriver program="C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AddDicomPrinter.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Windows\SysWOW64\netsh.exe
    netsh.exe advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=in name=Add DicomStatusMonitor program="C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOMStatusMonitor.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5380
- - C:\Windows\SysWOW64\netsh.exe
    netsh.exe advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=out name=Add DicomStatusMonitor program="C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOMStatusMonitor.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5936
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:572

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2872

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c4de.rbs

Path C:\Config.Msi\e59c4de.rbs
Size 150KB
SHA256 5c98606c7418c331c5cafa288e0a0f0010c7342eaf339f44605f1622172eab23
MD5 eec90fa46c14db8ec79ec40ec0be1dff
SHA1 7f90492bf3787d22fe345763fcda29d069fd5b60
SHA512 6327bbd480cb49f27e0ce1285003ba3ea76352c74d47ff9663b8e5c7d791c49cfffe3215b64b49e59019b99a8c2c0fd4c83ea12b39045f8bd6c5bc89b9507b9e
SSDEEP 3072:N3k2ReaS9D03f5Q4wZhTaC6zbV80c1NH+menPpAoDKyRyW:oW
TLSH
T15DE379417A40C643C0BA1B30ED9B3F097F76A7D983CA468B41DDD13899837962EAFD49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AGFA_2000C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_2000C_20.GPD
Size 1KB
SHA256 972c30e0cbb5f39d806e0131350997d357fc2ad42abc4d905ca051a8f62d6456
MD5 98e5cbe732ea6cd1940e630439ae1f6d
SHA1 7ef09a15eec5f57e97d8ca68503467b2f25082fd
SHA512 6f23438d93781599235e39918da6ddc1068135497c81df7730d458bb2fcd4b520648aa6707022e010119bbfd33b1fb967f39b2f6d0203eaf1d526afd6a284ab1
TLSH
T18B21878884AFAC9A77B61612AE14D2D6EDA4374B00626938711DFF2C1FBCD40C052F48
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_3000C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_3000C_20.GPD
Size 1KB
SHA256 5b3657f7d50ab448d057338f2c38a0ab2d83a3897f505dcb6665bd1f6435ae40
MD5 cdbe275b4480efdabbc321a797a329ba
SHA1 aa85923f8c61842f524b351c5550ac5c53f4d785
SHA512 71d04702a4ba7da1e2c67b9e7adcb81a32c61e19851286044074aef1c173de4d4f6246c60546106337098c0a81e8dccd49b360b0beaa58b31144b31a34c5edd7
TLSH
T1BD21EB4880AFAC9A63B622129E04D2DADCA4374B50A35C3C705DFE6C1FBCD00C412F88
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_4500C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_4500C_20.GPD
Size 1KB
SHA256 91a0b188a94980ce62e63bd3d738c61e5db3ef83d5f20e5db922ebb0ae28f4d5
MD5 3cbf207f8d98a80184ccf0d7bfa126d6
SHA1 bc459a84acd5a7d2e9d54fcbfaa08060ff5087aa
SHA512 f4c87f6252d4519fb9e7f6441aabc03481bceb8eb384895ad86a3ad523a02b19c6798a5d3fd8a34bfb7074266d661fe558f0fc424929a48bb8b3d80c62d40452
TLSH
T1FB21794CD0AF6C9F23F60612BB1592DADCA47B4B00621938715DFA692B7D901C152B88
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_5300C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5300C_20.GPD
Size 1KB
SHA256 8d3095200f4ff82e7b8a1e250db502b37526d1e96931d5a43f47a4a4a71bb2ec
MD5 ddd75e23d162f04251c1a0b2b6f09ce2
SHA1 c46542efe57ded3d5657ce044d60e937b52014c4
SHA512 6cdd4e2774670b6a6030588dbc63797fdc25cb862c99710d9aef9ab0a9a21d9fcf4f628228fb7e3a705b55d3048230663163b933b6c217b364942897c4aff962
TLSH
T17421DD88859FAC9E27B626125F10A2D6DCA03B47406B1938701DFE6D2F7DC00C052F48
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_5302C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5302C_20.GPD
Size 1KB
SHA256 989f493167dd317e45f391b54e6762eb6214f98be71cf53f3f302b6f8edee7e5
MD5 e3fbff60d602cba8af421155466ae15c
SHA1 dcd0aea6ca6fc396fd2178dcfcad969e94799279
SHA512 d6d2cd45bfd9c8eea79450acc9e953481405824b3e3606aac28b8a5fa30739bb12e1a1d8d77bcc7f9d6aeaa0f3473197e8e79e4fcf1fd85c6695d0d4da7519d4
TLSH
T19631788881AF9C9A63B52212DE1492D6DCA02B475062193A732DFA6D2FBC8518492F4C
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_5500C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_5500C_20.GPD
Size 1KB
SHA256 125aabc20d8b8ff4baae4a0928ce855c62f9f112cee1cc6a936a04b3a2ad6002
MD5 0b31dd0b6aee2c01572d4938735c5659
SHA1 6e5342cbd7b8e8681878fcd8fdd674eca2b38528
SHA512 a4d0fc81e03a92156eff76c0ebe2a447562f7297ed5c05536b078cd15e048f6c2ae34fe40852a9ad471d9a6d9830724d640fa03092bea4a3509381478dc83e46
TLSH
T1DC318B84C49E9C9E23F91615DE14D2EACCA06A8714671E78701EFEAD3FBCC518452F4C
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_AXYS_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_AXYS_20.GPD
Size 1KB
SHA256 86e5f17afa0c2663d6708b4beeb5d2f559bc01e14e0cacdaf7dd516099618605
MD5 ec7b7c1af451e2de9de6920bc4a4db6e
SHA1 a0cfd26e1114e69c015168d79de0d92327cffb9e
SHA512 492424050cf52fc29441dfb6ac31aee4e58dd3c43c3c3e6a0fe2bfabadc64b62b1d6ed13f9a7275d64c4731180c39025f49ac3029ceb308a756ae9dd59eed771
TLSH
T103315588849EDC9B23F61655DE14A2E6CDA42A9351231E38700DFEAD1FBDC519862F4C
MD5 SHA1 SHA512 TLSH

Submit Download

AGFA_LR5200C_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AGFA_LR5200C_20.GPD
Size 1KB
SHA256 67a1a2267b28ba4b67a6d77f7460d02f742b560bb386044a40a912fc504bd4ae
MD5 b8945e329f50382c0c75cdd762d07573
SHA1 1a674201adc9f85b69884ab4534029f8f45f76f4
SHA512 be2dfcbd4743f65229c908247cd2ac0b9de02e9a91ee52134b7114cf816bc5e14870aea5fc847038990be0fb2d2c79a57f73e9e15bbe1a1ae044106c5a6602cc
TLSH
T15B21AC8884BFACDE73B92711AB1492DADC943B4B006B1939711DFE5D1FBC850C452F48
MD5 SHA1 SHA512 TLSH

Submit Download

AddDicomPrinter.exe

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\AddDicomPrinter.exe
Size 432KB
SHA256 5a4b567401cbc4003b6a4991ef7c09f1e0d035e080395ceb7fa5bb838a586a2c
MD5 d1af78e0412b748e4abd56f7099d1a1a
SHA1 fbccd66c16eae0532acbf7f255cac09440b6dc9e
SHA512 19c9291b7b505ed7ab6a9ef54b7b8acf9eca888704e2567901472d6b6df3c4459ec32385fa96aeb221ac2123ee1d6fdf75bf4f721836dd06190f3755a51aebd9
SSDEEP 3072:7XH6TMIuIQQaqysGMScAnCa6G3roywxkB7SqotGvPwmBLGebMicxz59BbCNbLxhD:3JNcAnStPcILCNi
TLSH
T1BA94A10267E98518F1F7AB30AD759EF13A37BD678E34921E161DA62D0C31AC09D72336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BridgeToKDT.dll

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\BridgeToKDT.dll
Size 152KB
SHA256 f10e4be3d454d23e0f755044771e7916655bc626bff312f155da90fced966c34
MD5 ff3ebaf9414bdaff8009a5ec28fe3ca8
SHA1 2c01e52b95f2560da8e085e519183b93dd75b6f5
SHA512 00cc94232f10d1895c2e6abbf842dbf6ffa196a22a3beffb81e8ec9af22cdceaab433f7dd1af79cc6ddc7778f93abdf8bdc14dc2c0d425f77d2722a0c80a3dfd
SSDEEP 3072:AVRFOcL5bqO99xVBzOaIzUR7Uz8I09mFkgFfxEUYB/AlREdD:AnFvL5WcxTzOaIzUR7UzjK
TLSH
T176E30B02F2A900DAF1AE233C59B93775F37BACF9CF20995B3364EB6A14358918D31516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CODONICS_1660MC_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\CODONICS_1660MC_20.GPD
Size 1KB
SHA256 e32ee159a673d32b33f5265cdd98c6a12b9ad0a9422ad825631f7e2690f07bae
MD5 4cced0096beab7bb3f84bd41feaa50ee
SHA1 b51fd5d774489df6ce655b339b35f1baeb6325d6
SHA512 d8a91c7f492932ea1fc33fd3d464382c48794cc478341cc0f9b03c2e50d01c43ed6cd5bafa3b0a085022679f32a473286e3b176387a330c67a6dc05fcf37b134
TLSH
T17F31699881AF9C9B37B107A1CE20D1E7DCA4265214671D7A761CFAAD1FFC9018C22798
MD5 SHA1 SHA512 TLSH

Submit Download

CODONICS_HORIZC_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\CODONICS_HORIZC_20.GPD
Size 1KB
SHA256 43c560b390a3d9618a63b2b912d2d2d4ff92b126118756ea130f0cd804f8c0a2
MD5 035b23f5990fae6f8ecbc264830302eb
SHA1 3806fb2e433c6ea28094e1c7c9ba2e5624519830
SHA512 9b8c6342676dc6442a3e580e0e4aca068c76faf9597e8b798f1e14dd0240f76bed60822f769f53a54eb2978c94357827a26017c30994dbbc395a1c7367040c6e
TLSH
T18F315BA885EE9DDB67B50551EE21D1E6DC903BA708226E34350DFFBC0BFC9014C92788
MD5 SHA1 SHA512 TLSH

Submit Download

DICOM Printer Driver User Manual.doc

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOM Printer Driver User Manual.doc
Size 234KB
SHA256 a47ef39d96f717a783ff02b88b7fd403896f87077c0e207d0e16b54f1ec95b35
MD5 b7222c171b3634d20bba16bbc5df16b3
SHA1 b2910e3028634d68db79ec2fcac153e5a2c19d93
SHA512 a54a7cc442caae2b3c031aba7b30c3864a7883b3c212347825b55231e788f4b6198bbe413b84652fd72feb01b0fe2e531de75df3acb0ae0af893ed86bf79228c
SSDEEP 3072:gJXIlE0YFoTRnXCowfa7s6jg0n1BesSV3:gd+Y+RXHwfaI6jg0q
TLSH
T1B5344A07BA661F3AD016163645E70F926FBAEC98BD2743071378771C3DB22646D027AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DICOM Printer Driver.chm

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOM Printer Driver.chm
Size 369KB
SHA256 3a016b6c53414a527da46f68fd6b90853bf5a7046d56ebe352ecf25681251aaa
MD5 c23afb424030467a7ee0681b2c274ad4
SHA1 af8544e1e8c7d567a042f1d100cdf4405bb8a817
SHA512 3401f2d1f35db05948a5868b18f28764ac7a5fe0cd7c57353ee96ef8624cf07d567453ae67b5612856400883ae4dd58ea52aba3db1759a66edb255a43ea3b8dd
SSDEEP 6144:IoqDdKk0dTHtQH0x4EJSGw649nw8In+XI7b5IaXzaXK9bRRZfbElMZgO50Q/pGoj:oDdKk0dTT5NvdN9bRRFb5HOwGoj
TLSH
T15E8422A70D7C8EEEE0CDC035522FDABC7E613D7DE46934C25E1C6218A34B309B666466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DICOMStatusMonitor.exe

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DICOMStatusMonitor.exe
Size 156KB
SHA256 f6955bdc1780f4918f4a701dafddad8a0ea5cc0f7ad490f5cd6da403c93f5fcd
MD5 3dc0b9a37b0ca4c66f36debffbe29b7f
SHA1 438a67fd1f4bd95a436939f176a545de9509ffbf
SHA512 cb7859fa1138cb876b01dc269a00b491c68c39dca93d36a56df5672f7a4b1d14c0d57c23ce1727e7ed15c9245442094e16a1ba831d4383427ff5cdd52fdc8439
SSDEEP 3072:lfw8VjMgUIErbG6uoQ2Sn/OZ1R2xZLq0Qm:lI82ggrbG6PR
TLSH
T1B0F3A413E3F98649F1F3AB701A794B765933BEB4AE3DD21F1250B51E19329809D32326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DicomPM.DLL

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\DicomPM.DLL
Size 248KB
SHA256 e33f02da15be60897103a4b6627854c93f2ced2b04f432229c74c28a94d3d5c5
MD5 4caf26d9677f4a55d04601de67ca91ba
SHA1 31b6f63aa3ce963e9a6e78414b912cfa0a637359
SHA512 fdbd1b62531ae309d18fa104f097068ce46ade421710bb302f7ac575e53fe181f4dd96121fc241191c449b8a0071cca04918ce0e6eb4e8f52ce7a111bc9523fc
SSDEEP 3072:owLNcLdGi+baQcEyd0h1ZgjGS/ugVJYPOZZBftA8E34s9ChZvOqj/4o1fgv5RU21:oaNudBEa0nc9fa8EohlNk
TLSH
T1A6445B0172D080B9E2BB5B30196BD7F6B6BDF8B01B37F60B6358DE191F31490A912766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKDICOM.INF

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM.INF
Size 18KB
SHA256 fed80af455a5309671992a5953b16e68d0801fb5ec5889eefae622c012591654
MD5 6edbec7d295de86b253f4d178a2d28c3
SHA1 95e82cea104efdc7a8aee7ff585d34f142099234
SHA512 7a58bc73ecb8fb79baef043be7a529502c3a6241cc1ec40526c64672e24e6d740746288b68e179134e0fd1cbedd080ba22d2c544a508176890949f935e284078
SSDEEP 384:gRikqDc3Bmtc69pUadqtbW+hF0pue+pygKuWq+G7KLaylwfpmtDdWqO6//uqy3XR:qODc3Bmtc69pUadqtbW+hF0pue+pygKe
TLSH
T1F3929CC158198EF5B12BBF6B59B3C8C32B6A220E4DA15CDE352DC0239F8DD41191BAF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKDICOM_20.INI

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_20.INI
Size 2KB
SHA256 3f4bb1d5b5c5f9da833ee2b4f486d07b696e8346ecc4ca2d90e0f1f064e5a9a6
MD5 979c97a09b568fa1e8c84a98b8042686
SHA1 1581e362ce1d36e482a8b635ac7b0765b4653944
SHA512 d356dff605355707917bec33cf556eefb8ac4b4de02de5e976b3c5dc162315aa73165a6a833f6680f6bbdef1a45378e02819348c7209ec24a43313f32e5eb7eb
TLSH
T1F541B417A036B6C36237048A33F2F79756C77ACA61546891B0FDC6037D94C2AD2AECB4
MD5 SHA1 SHA512 TLSH

Submit Download

EKDICOM_COMMON_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_COMMON_20.GPD
Size 4KB
SHA256 7304f1ef573b7ba2b62acfe1d44db1c317d31783b1233f6d1f8c8332e1b22923
MD5 ffd7c2d50d4d93bd1975fb6fc778de40
SHA1 a7ba65f9bde38ba4a5ead44c0a5ef608a2170bfc
SHA512 520a0160e058ecbd365c1f0e3e64faf213acbd840d413e65ae5efd672a33f7a67ec1d88dba125c8875375920252df4c69e07566019302fc99cf11682cf436610
SSDEEP 96:IaqH4H4n4T4h41wAicHxLPdLcPuRCcY0hv5B3pOA80or2squr2sqMjyfLBVLcPq5:InH4H4n4T4h41hxZh9Kr2sLr2suz6oQw
TLSH
T1E6A1BB7C28C74E8D35772B36522B6FE1FE251B63A091543638ADFA255FBC1509006E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKDICOM_MEDIA_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_MEDIA_20.GPD
Size 4KB
SHA256 6f558a2d7c37223525b29d3b997d39ea0839c3e07ebf4e8f07eca8b9a6d09a3c
MD5 0db21cd63af8970bf13cb6c4e36f2875
SHA1 4f9da3e117ce0bb050bd4909411a34ff8e1f5715
SHA512 34b6651af18aef70159b0588c971ad56aeb29b929f1b5e7e09eb7d410fade1026941e2ee669d357499425949e15189acf6924779aa1116e9a74c2f0d4ce9ba9f
SSDEEP 96:IOMpURSn2NFRA1ni6URpnCFR71nsRonSFR21nMRSnARyn+2URFn3/URgnYRKnsR9:IOw2N8FKCXF5SyFXZWpJEOe/QwJkjE
TLSH
T19C91272C69D29DAEA2365F3663572EE1FE6113A764A188367E5C7B398F7C1014008FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKDICOM_OUTPUT_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_OUTPUT_20.GPD
Size 3KB
SHA256 a5e257be0342270913f245ba631d3041848514b76d80c68eb45e17c84ee6fb85
MD5 f0c9333612b697d90f918cff251a050e
SHA1 1849afc54571cad094365510e5dc9fb162b04a0b
SHA512 fb0d70df071ef757e2ee91c8d9ee5d2269734950129b61fcb88c3d7bf37a98f4baf920f5abac92e2fdbfaf8a70c0b01cae308a8d3752d93ac9d8ebf03bbc350e
TLSH
T1D561281829E24DAD32BA9F7A57671FE0FD5516E3A4578C2A396CFAB90F3C8018044E4D
MD5 SHA1 SHA512 TLSH

Submit Download

EKDICOM_PAPERS_20.GPD

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKDICOM_PAPERS_20.GPD
Size 67KB
SHA256 dcdee355e84619e45dd5e920ec6d56d23729e0e6843f99095fe6497023f300c0
MD5 ac04b48ed5d8d86f9846a24072597709
SHA1 04fd882d8be6d7d17f4295cbd60a10e3c48530ab
SHA512 55a69c6294d3549645254d43a0c42369d443a282c9072704282ca6f61c0f67702e79a03b2c05c8594eaca0e5a60be6b9b1887db33b15ce73c338d8aba8ae87d7
SSDEEP 192:I0DZ7w8Lz1fcR90oHpVJgM8xAlbgT+oY10cSD9mb8eLbHA6/5D8mg9dOg+PRkGrj:Is8yHWx+gWhiQqRPrjmv/rO
TLSH
T1FE638D4D29E05DE8523F9E6B576B0CD5D9A60E3BA0B9DCB9359D3A780FBC8085101F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKdicom_gdi_20.dll

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_gdi_20.dll
Size 1.1MB
SHA256 3a0d4fa6a7b375c1ab68baf58d935715a260e4e3e493814b7798c638958a859b
MD5 01d2d33f138460af03768994ae30f732
SHA1 85dc95307835084fe153474b986d7796f342c3d9
SHA512 ea69ac9b8bd4a4653841f306ee6fe8d6ce76e9fbe9ac9f29ce85ffff274d877dc4e9bbc72a0d34f7acd049850011187543c2b6ba98eefef3a5e4303459deba01
SSDEEP 24576:H5qo6UkzXUr22rv4OvJz21hhgP8opIFGs/c9JR1bWXLmUmZMKmFi4z1lhM0OZKNl:4nzXUr22sOvyO0OZ88gCM4OqAy4qAdfF
TLSH
T1BF358D53B29500B8DB1509B0A8FEB7B696385BCD0B13B6C36348E8DE65B2DF16633507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKdicom_gpd_20.dll

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_gpd_20.dll
Size 220KB
SHA256 3aa1bf4b342e11d549f4435b59fc9af66ab483ff49ef771be8531b96be985e73
MD5 b338428ba0e7579a78bdacb422d66e29
SHA1 04edcfd7881e50acb6178b8d829b1a2380589adb
SHA512 915b5459dbe666906a1ff81c6ecdf05937c2a80c84e0556a4a5c70df7744d2bbe1ed9d73dc6a05806090fc83aa0dc39b9e2b7fabd38efe087a09bf6bd469b42e
SSDEEP 1536:RO5YT9w2wQjRky6kmo3GgnKaUxBn/efVVOr8dKqAQP7/w+OsR:ROLrO6kmo2RBn/edVOr8dKqAQP7J
TLSH
T10624EF146EEF4516E1B3D3329FD188A3D9B6B65737B6410928CA036A445344E0EAFF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EKdicom_rc.gpd

Path C:\Program Files (x86)\Carestream Health\DICOM Printer Driver\EKdicom_rc.gpd
Size 9KB
SHA256 52031945be83121823dcfc01942dff4fcb3465d81072bf4b3cb43db2cd08b9b5
MD5 cfbc07efb6e6cfa114aafbf4b4328ace
SHA1 23cd49602b6c36ad575125970f72f651f9f28fb6
SHA512 6f4b6a42c78935be3f089a1e314e796655803ecac775d1491871c8a7763a1e36a5d615ae166a0bdcdb05faea5e27711b64afac1f2690fac274042a8bd375bc29
SSDEEP 96:IG2uIXqSRnLQQ9+gs8M82wvA6OfuLZVK/5N8cCl13sTVl7zPRD7/XsE:IFqSRtQCl1khl70E
TLSH
T100221EE90591196CDA7DD4642752EEB9CE4C6D3F387B28263A1E37C21F6C91913CE48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE7D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIE7D.tmp
Size 122KB
SHA256 1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca
MD5 2c65cc2f1516e8eed2f01ee5efa60c93
SHA1 fa8ace92bdf6cb522357384b352389d08b0464de
SHA512 f5a55023883795a0c27020ffcf6b4a33c37faefa808e45afbeea1f1b8eb07c4b6a82ef4dfc729d66d8cf93f8f7ffaf3f36e0c7c1cd7cddd76934b23380567f03
SSDEEP 1536:TEBjdyQHtCMdlmWkw5fdRjsJFD2DlIBjAQRFYYBcUPook7hE0deQf4q5pqER9VVa:4ptCMbDkwnfWBkNYBc/3Fnvf4q5pqwZC
TLSH
T152C3492177E0C072E4DA2A391935D7625A3FB870AFB8D5CB73540B6E1E307D1AA36316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is4E93.tmp

Path C:\Users\Admin\AppData\Local\Temp\_is4E93.tmp
Size 228B
SHA256 7a5ac3212314b11edaf6d3256f889733e3fcb8eb401eb69ab2143d2688b8e0c0
MD5 5e8b1246bcf003c5da0e3912bdca1de1
SHA1 5f40f30b8259dd261e246dbe07ccfd45c9fe8f76
SHA512 aa262e440bb15f2ff484726eeb7a6e71af53cef1a8d05040018751a0f7ef438857ef4c9973b9cddc5b9fe4de072a72dbdbf8524f109c81cc7b133b4a00869f9d
TLSH
T1A5D023F43E6DF054F10D50464606E3ADA13047A594BDAC7474F5D0C657491F1E3D392C
MD5 SHA1 SHA512 TLSH

Submit Download

_isF369.tmp

Path C:\Users\Admin\AppData\Local\Temp\_isF369.tmp
Size 1KB
SHA256 cdf733af5d3deb0876dc5698ae691c72856b3e580b59724c941810be1780c9d3
MD5 afdbaafc4b5f0134905f4211fbd179b2
SHA1 d14e1c6a4e74276439b47e5fb5ad48c36ac62900
SHA512 f29406e1093e9f6c45d5305cb6606f97c37e3c031bd53dc413e29a0a29ba686b24e4c9f24ca45b0e45c3382fb523dcb5093b6e16c6f2e5e5f4bcccaee709450c
TLSH
T16F2128393262B0B08668C042BDF1A27642DB053EA7B98C0B519B4F20A02EBEF57431C7
MD5 SHA1 SHA512 TLSH

Submit Download

issF58D.tmp

Path C:\Users\Admin\AppData\Local\Temp\issF58D.tmp
Size 1.3MB
SHA256 e8d6c6ac415a03c019e03d470bb1430a9d0eadb99f8a219fae6cfd0c9b45818e
MD5 b603988d48176b6391f9780719646d1d
SHA1 a4eb7e26d7f810c5d723768205a56f6946af222a
SHA512 232439138eac25aa7a0d267ce902d8196cea1cee4858274993daf5b193a1ec896454a347615033954a4b3234fd3186df710ee07b866032b4162abb4e278f13fd
SSDEEP 24576:9/QqSNOOuBZIfDNbGbOQhRzegR5I/twXUWVU7hcd3+bIZlfhUZPYGkQgA2Ww:94qYOOuBCDFcBRzlzU/qckvJUqGkQgkw
TLSH
T1C1551242FBC3DA91C44C0932985B63EA0F70AC49AE17A39737993B5DBD73395B701298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IsConfig.ini

Path C:\Users\Admin\AppData\Local\Temp\{74BB7EC4-2947-4206-8539-4DC84E5FB75C}\IsConfig.ini
Size 321B
SHA256 4d7ff896d1c8afcf54a1824f5e588a872fa98723280a96fae04f3cea612eb653
MD5 1271c599a8dd32f1d3ed3854479938d0
SHA1 7fb3a0aa8a93b365d15cfc98c40191bec6ff7389
SHA512 edccc492d374e60c4d213f1eadde83933b5103e0bd662110b699311ce043477b7102d8fc6fce6d93dfeeaea5ab1b503c88976ce19a7628ec13957dcdfba9d47e
TLSH
T1E3E020CA745EF36151318977157F08D84474344C12B550D5803281C05DA179F02DEB54
MD5 SHA1 SHA512 TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DICOM Printer Driver.msi

Path C:\Users\Admin\AppData\Local\Temp\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\DICOM Printer Driver.msi
Size 6.6MB
SHA256 f2a54d67f368382339348faebabe42b50edd21fa9b2d76e8353071500fe1deff
MD5 c1322243db0e621b70da5839b096216b
SHA1 374ef4823c03d650aacdbc163f8731ca96098564
SHA512 149038368d062f698121b5e81affdb6814778952a65b19be4ee2577208b68910c1376d2ae5dc4f92ea97b526a77e7e5deaf647739b413c38dacb5a8267b88090
SSDEEP 196608:Ijrp8ubyGU6HVFH1Z1SxSfyYd2nkeeXj0vURl9fykXFD:KOjnW0QffykXt
TLSH
T1DD66F126A3551699CDC507BC53710997797AAFEE8E832F3BB6C1382B1970B6C143368C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{83A4A7CA-1F60-4E07-9AD8-070E253988E9}\_ISMSIDEL.INI
Size 272B
SHA256 fd7142fb8c8823e7ca7a5f70b48207211c09c86aad55c08ec1ff37f9f210afa6
MD5 af3156decd3519283e8eafd3952fd446
SHA1 3bb9a711c7ac1439d77ad6fb1a709afde4338c1a
SHA512 189e3e6ac05ab9a07b377bcee39f3f615fc400843d2de7a9046b6ab6b0e65c9b528d4eed3969b11a81294ca7e42724895ba64eed5684a2ea0a5e9e5ad253fc70
TLSH
T1A2D05E352CDC113B92FB9C889BE18461FB38B0F03A092D5E40D3000E09D1E1291A2BBE
MD5 SHA1 SHA512 TLSH

Submit Download

ISBEW64.exe

Path C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISBEW64.exe
Size 104KB
SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
MD5 b83d2774cdaf5016cd8765a630fa1150
SHA1 50b7f86488926c6b06322af6a5176e4c7786058d
SHA512 90fd6c47d658491acfd54a1cb7d76bb01c3e6f58b4df4466998411d73e497a305dac13798182448289052f836c92958ca42b69bb14549d51aea4a0f92e665727
SSDEEP 1536:XDEbW8/KCWYxcnGP48IA2h+k3ZLZwyzHoAoS5RQjKRyVCUA:XDEKrScnS4rAI+wnHoAoS5RT2A
TLSH
T1D8A3295B77A4A0F5D026D27AC9929A85EBB2BC601F6103CF2721A39E1F337D15D3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISRT.dll

Path C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\ISRT.dll
Size 258KB
SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
MD5 3795427182d2dc8ce5609a342bc65313
SHA1 0e53a85d991526a9191d3b0f3007363b3649faf0
SHA512 6c3669b38b67ee37d99f452ad6b0f58102fd0db952e9f146b8e0ec409ce5bc61052d4cdb23c2eed4183b18baf529c86ac95bae420a90908d58d5f4399b0e1b76
SSDEEP 6144:4w2aRHD/ToBCIqR8qJsDW9L4yR3OSc27xbOuU0j+2zu:4iPG3DWqyR3a27x6un+Ou
TLSH
T15F4423A3BD494D2DF8864F3A37BE12B4543C3D367E605C13A021D9934FA076811BAB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

String1033.txt

Path C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\String1033.txt
Size 170KB
SHA256 92f01fc14799847d9776c51884cfa0fbf8725f6d2d6ba634c64d251c33fa68e9
MD5 508176a5ab93e605747dad8a8db04196
SHA1 4e5281bb0228a0b76aa4e4ae4c1c404fe0835e0e
SHA512 7ca6554ea2589473c14cb5d8d48e972f60decc6c2d9f22f15a868ff6b6933e9b8d5e66da79636b78d74329db3b1798d05390ad853f94cdf777036cc54839085e
SSDEEP 1536:Or/LR6/K410BrChTHB8I3d2MWA/z+wKZU6rPsH8QvvOuyMJice1VeL27ZK:OrLu1XTh84W9tbOz
TLSH
T18F047C56B7FA0218F5F3BF91AEB551649E36BDE6A83DD21E0180104F0AF1E4099B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isres_0x0409.dll

Path C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\_isres_0x0409.dll
Size 540KB
SHA256 90ce1658595ee7ee977d8dce4f7a070426520f20fa38867b9ff14869ad8ec598
MD5 25f79c8f92b15d20d57142d27b43d45b
SHA1 4f9f50ee529ebd0b9e5f81958dfd33a5c3c912bf
SHA512 c989c69be10a560dc725c4433c48c6099da892b0ba21f90e5f9f4a68ce8c3cb630a9ea548da9781d6862d2c3408273987764e351598e614dbd6c76a90ea9e0c3
SSDEEP 6144:hhs4d9dcOaOdXGJ3hskkkkknffCp5CrRKlua8AHqPK8:7s4d9dfaOdWxq1qv
TLSH
T1E0C47000E6E5810EF2FEAB7498B21BA54EB23C519B3486FFBA95711D1471AD09C31F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.inx

Path C:\Users\Admin\AppData\Local\Temp\{D504AC58-4495-4D2D-9779-15E639662B7E}\setup.inx
Size 266KB
SHA256 e16d8fb9be78d3beb7948889f78995fbe46018f964976249a33e371fb24ddbfc
MD5 f12e4070a4f47538d5b15a48a34b6921
SHA1 69a1962d9b0595a9143403e9e9ced3c76a8de6b3
SHA512 304b4f9294b5c3d468658f6e2a0edc8fa2ec4d88d00d667465c8fe48d41ab9d12b77a2983e063244d286294e02f01d68ece88af49e5811095196108d37f63364
SSDEEP 3072:jiG6bPOUVpEURJqjRZRIznb84KbO4HxeSyzvL9vrwdt8LGsIfA5NwqpqaJ6gs68j:jF6bPrVptIRBtO4RJmRwqf3iBHc8IEM0
TLSH
T1EE44AFA88D960FCEB3388ADAE43708D039C5DC4DA1E596A793E2D5D08F754F950DD08A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~F346.tmp

Path C:\Users\Admin\AppData\Local\Temp\~F346.tmp
Size 5KB
SHA256 5348dc979acc95fc831f105c51a9f24dbc33bd61426e65d84b9ec265b1c7ba1b
MD5 6ed3f84a6524dcc1ddf8831fe6f3d82c
SHA1 3dee3e53fb44e2d99734e3b5ea17b5a3dc911797
SHA512 0a606894d49a91622686bbc1132f3eea4cde6409bfd0d88e47b09ab0d4244861b9ddf6a1ab015c6b4862c63f8934113aadc06f46584033e10daf0d1f9fcd4f28
SSDEEP 96:rEhkMfXgEgrUva1ONUXsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvln1:YhGFUScuQaEZhdxoIWRGcQbPr/p0050m
TLSH
T107B1CF172BFA011EF6F35B44DAF0053787273C11292CDA5C55D0875A28F6D824A67BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 d3261630e7ee7553dcd6e84f6dd9db58045768749dba011aabef0f244c6836b9
MD5 9a5c7b258a9b040b771a0d39aa40d97f
SHA1 a75a4ba0d8c7ab211c369b92ee809e7161159ecf
SHA512 1ae0497b92d161f98367b0f938cd066b3e05874864b5cbe0153e61611f360d3448524ca9773dff3d416eadbb588582ed7a97cc1620842499b56a97a8cd558496
SSDEEP 24576:BFo3DMPxdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4Nul:lHM
TLSH
T1AE57F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{620320b5-0fcd-45e9-ac94-2b1452155915}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{620320b5-0fcd-45e9-ac94-2b1452155915}_OnDiskSnapshotProp
Size 6KB
SHA256 0cf1d1edbbfe18dbe931b3c0a605fa4505de26392b449602afa9f00a8f7335c0
MD5 272f68cf0a629f6cb9d62e4f444e99d2
SHA1 ba9657cc8a37b91daaca017e1f9b65bbe21ea4d5
SHA512 f338144f36b15290a4ffe08262f58ad038e152717d13b55f5d205572b9b82d598bbd7a035d7bc12708aaa098049dd852a49d4d9aa9a045211715bb30f71bd280
SSDEEP 96:FZPbGvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:nWb++uVmN
TLSH
T1A5D187085AE54711E2F3AB3128F18557A877B911EF33CB8E0298238E6670910F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4640-104-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4640-304-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-258-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4640-269-0x00000000038E0000-0x0000000003969000-memory.dmp

Download

memory/4640-271-0x0000000003310000-0x00000000033B6000-memory.dmp

Download

memory/4640-125-0x0000000003B50000-0x0000000003BD9000-memory.dmp

Download

memory/4640-126-0x00000000038E0000-0x0000000003986000-memory.dmp

Download

memory/4640-270-0x0000000003310000-0x00000000033B6000-memory.dmp

Download

memory/4640-303-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-121-0x00000000038E0000-0x0000000003986000-memory.dmp

Download

memory/4640-294-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4640-289-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-342-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4640-344-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-343-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-345-0x00000000039A0000-0x0000000003A29000-memory.dmp

Download

memory/4640-347-0x00000000035B0000-0x0000000003656000-memory.dmp

Download

memory/4640-346-0x0000000010000000-0x00000000101B4000-memory.dmp

Download

memory/4640-279-0x0000000010000000-0x00000000101B4000-memory.dmp

Download