d498fa38f81db81c261df64e675502bccc79145063808c3395de2f3d2e2f7c94

Resubmissions

18/07/2026, 18:45

260718-xd4dvsas9j6

18/07/2026, 18:40

260718-xbn66aas5r6

18/07/2026, 18:29

260718-w4zb6ah13q6

Analysis

user interaction
yes
max time kernel
142s
max time network
147s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WM4051_Basic.exe
Size 54.6MB
Sample260718-xd4dvsas9j
SHA256 d498fa38f81db81c261df64e675502bccc79145063808c3395de2f3d2e2f7c94
MD5 a98dfbaa5a7f6f6153cf133810172594
SHA1 fa0910232b8917db116cc80b844a08f7b055d4d4
SHA512 d889769f521cff9b2967b716e105ca4bb4e0b1c80413a1faa941d5b13781dc0227204db27ddc9c6197d83dfd35daaa6528a391c3146baea5f0298a30bd05f3b2
SSDEEP 1572864:JdQaC28wU1BJiOF+lyl/plEspx6NaoTNE1eANWwR4:JDClwU1b+yN7m4oTb2Wwu
TLSH
T1CAC73366F5589A89EA7F00394550FC48DEB5AC19D5080C2B79DCBF3E0DBB7CE166E840
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\World Machine Basic\presets\ViewportLighting\Lunar.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Scenes (Intermediate)\Island Chain.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Scenes (Simple)\Simple Great Rocks PBR Version.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\SNOW\Arctic Planet.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\resources\colors.txt	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\plugins\devices\DevicesLTE64.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Creating Larger Worlds\Coastal Mountains.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Device Examples\Mimic Device.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Qt5Gui.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Granite and Dirt.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Vegetation.Mud.Rock.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Materials\TextureFromPBRAssets\PavingStones055_1K_AmbientOcclusion.jpg	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Classic Mountains.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Limestone 2.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{7f64cda7-d796-4b2b-a94b-43f0042b13d4}\Dry Alpine.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\world.ini	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\BIGA\Mostly Lowland.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Mask - Red Green.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{4714d170-1963-4e04-b7c5-acd8c0620cbd}\General Grey.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\plugins\devices\DevicesStandard64.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\plugins\devices\StdDev64.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Assets\Icons\Macro_terrain.png	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Device Examples\Natural Devices\Create Water.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Materials\TextureFromPBRAssets\PavingStones055_1K_NormalGL.jpg	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Scenes (Advanced)\Pacific Atoll.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\imageformats\qicns.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\APRL\Default.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{278c88c4-a0b7-4b06-8d45-f9fa2440d268}\Structured.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Creating Larger Worlds\Example Two Part World.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COGR\Natural Green Variations.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ViewportLighting\Topo Backdrop.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\APRL\Lumpy Outcroppings.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Grassy 2.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ERD2\Fast and Light.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{278c88c4-a0b7-4b06-8d45-f9fa2440d268}\Structured Square.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\APRL\Hills with Rocks.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Fall Foliage.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ERD2\Full Strength.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\cTNT\Remove Color Cast.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{7f64cda7-d796-4b2b-a94b-43f0042b13d4}\Red Mars.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Device Examples\Terraced River example.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\COG2\Moss and Granite.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\{278c88c4-a0b7-4b06-8d45-f9fa2440d268}\Stretched.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Texturing\Basic Splatmap Example.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Unusual\Creating Lava Flows.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ERD2\Alpine.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\SNOW\Early Snowfall.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\platforms\qwindows.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\APRL\Canyons.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\BIGA\Flat.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\startup.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\LCRP\Original Scale.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\LCRV\Road v2.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Device Examples\Height Matching Chooser.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Qt5Svg.dll	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Materials\Simplest Material.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Materials\TextureFromPBRAssets\FromPBRAssets.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Simple\Rotation Example.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ERD2\Smooth and Balanced.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ViewportLighting\Mars.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\Examples\Techniques\Unusual\Board Game Hex Map.tmd	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\ERD2\Good with Terraces.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\presets\PRLM\Sunset.pre	WM4051_Basic.exe
File created	C:\Program Files\World Machine Basic\imageformats\qico.dll	WM4051_Basic.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7638.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DC9.tmp	msiexec.exe
File created	C:\Windows\Installer\e58680e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58680f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7358.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e586824.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6ACB.tmp	msiexec.exe
File created	C:\Windows\Installer\e58680f.msi	msiexec.exe
File created	C:\Windows\Installer\e5867fc.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5867fc.msi	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
2964	vc_redist.x64.exe
1436	vc_redist.x64.exe
2544	VC_redist.x64.exe
1912	VC_redist.x64.exe
1404	VC_redist.x64.exe
3620	VC_redist.x64.exe
4784	VC_redist.x64.exe
2540	World Machine64.exe

Loads dropped DLL 28 IoCs

pid	Process
4980	WM4051_Basic.exe
1436	vc_redist.x64.exe
4940	VC_redist.x64.exe
3620	VC_redist.x64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WM4051_Basic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000064924c57361694940000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380164924c570000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410164924c57000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f64924c5700000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7164924c5700000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\PackageCode = "51FBA0EFEFDB3494A815FAF727EE72D7"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Version = "237799819"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Provider	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\101D0B34220A4F84D940AB04C4BED135\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\101D0B34220A4F84D940AB04C4BED135	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\Version = "14.44.35211.0"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.44.35211"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.44.35211"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}v14.44.35211\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.44.35211"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle	VC_redist.x64.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2540	World Machine64.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	World Machine64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1076	vssvc.exe
Token: SeRestorePrivilege	1076	vssvc.exe
Token: SeAuditPrivilege	1076	vssvc.exe
Token: SeShutdownPrivilege	2544	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2544	VC_redist.x64.exe
Token: SeSecurityPrivilege	2356	msiexec.exe
Token: SeCreateTokenPrivilege	2544	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2544	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2544	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2544	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2544	VC_redist.x64.exe
Token: SeTcbPrivilege	2544	VC_redist.x64.exe
Token: SeSecurityPrivilege	2544	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2544	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2544	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2544	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2544	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2544	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2544	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2544	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2544	VC_redist.x64.exe
Token: SeBackupPrivilege	2544	VC_redist.x64.exe
Token: SeRestorePrivilege	2544	VC_redist.x64.exe
Token: SeShutdownPrivilege	2544	VC_redist.x64.exe
Token: SeDebugPrivilege	2544	VC_redist.x64.exe
Token: SeAuditPrivilege	2544	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2544	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2544	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2544	VC_redist.x64.exe
Token: SeUndockPrivilege	2544	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2544	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2544	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2544	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2544	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2544	VC_redist.x64.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	World Machine64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2540	World Machine64.exe
2540	World Machine64.exe
2540	World Machine64.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2964	4980	WM4051_Basic.exe	88
PID 2964 wrote to memory of 1436	2964	vc_redist.x64.exe	90
PID 1436 wrote to memory of 2544	1436	vc_redist.x64.exe	92
PID 1912 wrote to memory of 1404	1912	VC_redist.x64.exe	105
PID 1404 wrote to memory of 3620	1404	VC_redist.x64.exe	106
PID 2544 wrote to memory of 4884	2544	VC_redist.x64.exe	107
PID 4884 wrote to memory of 4940	4884	VC_redist.x64.exe	108
PID 4940 wrote to memory of 4560	4940	VC_redist.x64.exe	109
PID 3620 wrote to memory of 4784	3620	VC_redist.x64.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WM4051_Basic.exe
"C:\Users\Admin\AppData\Local\Temp\WM4051_Basic.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
  C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\Temp\{776F26B9-7211-41C2-A911-149D23F6526A}\.cr\vc_redist.x64.exe
    "C:\Windows\Temp\{776F26B9-7211-41C2-A911-149D23F6526A}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A4B263CE-A407-41C6-A4F6-57453FDE4F43} {4A03D3C7-761F-4CF8-BEDC-A2E385792F70} 1436
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{F1C7235C-774A-4D41-81CD-674A15C08446} {A66AF3CB-2215-4946-83DB-8E55334E26F1} 2544
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1032 -burn.embedded BurnPipe.{F1C7235C-774A-4D41-81CD-674A15C08446} {A66AF3CB-2215-4946-83DB-8E55334E26F1} 2544
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5A4986F2-FD0B-4E27-8BB1-C2984780D94C} {EF4B57F6-BE10-4E4B-8A73-85D5AA3D06B3} 4940
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4560

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260718194629.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260718194629.log" /install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EA60B20F-66C1-43FD-99B8-DD865086ED07} {4DED9DD9-5F97-4DCA-993C-FD95ECFC22CA} 3620
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:4784

C:\Program Files\World Machine Basic\World Machine64.exe
"C:\Program Files\World Machine Basic\World Machine64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x380 0x458
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586801.rbs

Path C:\Config.Msi\e586801.rbs
Size 19KB
SHA256 0e076ae3474109e3483ca132e132a86211d0ab3989447749f411360d347f687f
MD5 71f18837fce84efcc238fad01e6eeba4
SHA1 a3dc0a15d7fbd5168a113742299e3d8b235269d3
SHA512 23a4fd27bdf7ea306cfd43007300971f864534e90249e321d9b5b3e999e214da7b7a030307951b3934aa21ddfb2f9a7600859f731583217b6cd8ea3e4e5e7c25
SSDEEP 192:4TRf1kR815dXcFUADIc1L+W+y4+agPus57:4TRf6R8TeC81L/cI57
TLSH
T166920D426690C9D3D8766B30CD631BA97B76DBD59350438B50DC90308F93BCA2F9DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58680d.rbs

Path C:\Config.Msi\e58680d.rbs
Size 19KB
SHA256 11101ebbb249504a8a78cbaa86f41400227424d8ed3954c37b992d1dfac554e0
MD5 6980a9c729f5bdc840ec43ffde79f72f
SHA1 ef800e978109d1029fd5ce4121e96788462c4149
SHA512 246669bf4ebca8a5f878637ee69881d914b9cb51e392840d9d8c6d355e26ae593c9a8aa78e730da8d79a0bca1384bb20d4542951a783eb7147174b84a3039bb2
SSDEEP 384:fvOGnJXMjZ7Up+BFqiO6N0gJM0uJM0Goa2D8Lfv/8c3zMZxq+nNwzQ6R:fvOGnJXMjZ7Up+BFIAMFMR
TLSH
T10892CB026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1308FA77CA7F9D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586814.rbs

Path C:\Config.Msi\e586814.rbs
Size 21KB
SHA256 d8f2a29f8ce4dd931e399a0d8bfdb98d64e1e9ddea1ec534ca7457d01f84e46c
MD5 6ce082ae3bf4ce2d7ac6a459b01a5ade
SHA1 9c5022373d64223508b133d3352e1bb8e44e26df
SHA512 f35e208e52ba48c7e4f3d1bc872112bcb119f3ed501fb4a98d8adea31dc24f41fd84673fd4caadc3b3282609dc008db42d923ceb12f5437c42625db066f4fb4f
SSDEEP 384:flR4GR1nAKxNAUhUC7xJjrMNYPVIbS/EaKzKOF+TIBLkP:fLhJAKhCsl
TLSH
T1EBA20E03768099E3C86627B1DD671BA53F72D7D99350434710ACD1348F633C72E9AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586823.rbs

Path C:\Config.Msi\e586823.rbs
Size 21KB
SHA256 93f0b4d5169454a6344c083694441b0190125e1cbebb62d490aae5a361f246b2
MD5 aca5d01c2dc33f42948ac6e3d2b913c4
SHA1 0b3b2c531029c43daa781943f99d969ed6b323b5
SHA512 d20185503e2db5ff892fe98e74377e9d89bae898a96c73eb39f0fd598792852d0c094ed590b86367f160af62dc84c0b5d3ff12421a0b9bf5b9003f635d30f0f7
SSDEEP 384:mrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KYJXUJXsrr6c+0dWg:mdDIAZxEth/phSYujbJBT76crr6/0dP
TLSH
T1BEA2FE42BA40D2D3D8A62B70CD97672437B5D3DAA755474B00CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\World Machine Basic\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\World Machine Basic\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\World Machine Basic\Qt5Network.dll
Size 1.3MB
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
TLSH
T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\World Machine Basic\Qt5Svg.dll
Size 322KB
SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 03761f923e52a7269a6e3a7452f6be93
SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
TLSH
T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\World Machine Basic\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

World Machine64.exe

Path C:\Program Files\World Machine Basic\World Machine64.exe
Size 12.4MB
SHA256 dfbd6c3742f6777ad53b924481af2aea74013bc3468a9cc6bc244dca3b00d307
MD5 bf5159dc8bb0f2525a47efec7baf4fc0
SHA1 5d142026e6a9e42f3a143579ccfb1ed56ffdfb7f
SHA512 209f924d823f8cb3b5ab328151fe8164fb2558a6057913a02fbc8d10b3e4fd8f4b69dfac42fc4edfb34a7ccbcfd3bb501f9a0bd0299d5ec883bfe11ea7bef590
SSDEEP 98304:AtD0hlcyFtB0JbslKd+vCIhDZSPmBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8Nb:Aclcy/smKd1IhDZSZ3lt8t2Der
TLSH
T18FD69D03F7A109E5C463C074CEB65B22DB72B86807B047E767618A9A6F373E06D3A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Program Files\World Machine Basic\iconengines\qsvgicon.dll
Size 40KB
SHA256 42dde60befcf1d9f96b8366a9988626b97d7d0d829ebea32f756d6ecd9ea99a8
MD5 313f89994f3fea8f67a48ee13359f4ba
SHA1 8c7d4509a0caa1164cc9415f44735b885a2f3270
SHA512 06e5026f5db929f242104a503f0d501a9c1dc92973dd0e91d2daf5b277d190082de8d37ace7edf643c70aa98bb3d670defe04ce89b483da4f34e629f8ed5fecf
SSDEEP 768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
TLSH
T1A1137D93B75206C6E467C735D6D98A0AC972B5518B62C3CF8229C9341FB37D3783CA98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Program Files\World Machine Basic\imageformats\qgif.dll
Size 38KB
SHA256 36174dd4c5f37c5f065c7a26e0ac65c4c3a41fdc0416882af856a23a5d03bb9d
MD5 52fd90e34fe8ded8e197b532bd622ef7
SHA1 834e280e00bae48a9e509a7dc909bea3169bdce2
SHA512 ef3fb3770808b3690c11a18316b0c1c56c80198c1b1910e8aa198df8281ba4e13dc9a6179bb93a379ad849304f6bb934f23e6bbd3d258b274cc31856de0fc12b
SSDEEP 768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
TLSH
T160034B56DB7804D2E5138638C49A4E1BEA36F5615B62D7DF836680290F337D23A3C738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qicns.dll

Path C:\Program Files\World Machine Basic\imageformats\qicns.dll
Size 43KB
SHA256 f4a229a082d16f80016f366156a2b951550f1e9df6d4177323bbedd92a429909
MD5 ad84af4d585643ff94bfa6de672b3284
SHA1 5d2df51028fbeb7f6b52c02add702bc3fa781e08
SHA512 b68d83a4a1928eb3390deb9340cb27b8a3eb221c2e0be86211ef318b4dd34b37531ca347c73cce79a640c5b06fbd325e10f8c37e0cee2581f22abfbff5cc0d55
SSDEEP 768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
TLSH
T19B135B47A7A901D1E15BC238D59A4A3AD671FA029B52CBDF0169C92C2F73BD13C7CB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\World Machine Basic\imageformats\qico.dll
Size 37KB
SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
MD5 a9abd4329ca364d4f430eddcb471be59
SHA1 c00a629419509929507a05aebb706562c837e337
SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
TLSH
T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Program Files\World Machine Basic\imageformats\qjpeg.dll
Size 411KB
SHA256 fb4e980cb5fafa8a4cd4239329aed93f7c32ed939c94b61fb2df657f3c6ad158
MD5 16abcceb70ba20e73858e8f1912c05cd
SHA1 4b3a32b166ab5bbbee229790fdae9cbc84f936ba
SHA512 3e5c83967bf31c9b7f1720059dd51aa4338e518b076b0461541c781b076135e9cb9cbceb13a8ec9217104517fbcc356bdd3ffaca7956d1c939e43988151f6273
SSDEEP 6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
TLSH
T15794F742F1616D82E3D184BCCD95DD66D3503C2D87F786FB3A95B2FA3D32AA03925244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Program Files\World Machine Basic\imageformats\qsvg.dll
Size 31KB
SHA256 b3498f0a10ac4cb42cf7213db4944a34594ff36c78c50a0f249c9085d1b1ff39
MD5 c0de135782fa0235a0ea8e97898eaf2a
SHA1 fcf5fd99239bf4e0b17b128b0ebec144c7a17de2
SHA512 7bd5f90ccab3cf50c55eaf14f7ef21e05d3c893fa7ac9846c6ca98d6e6d177263ac5eb8a85a34501bcfca0da7f0b6c39769726f4090fca2231ee64869b81cf0b
SSDEEP 768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
TLSH
T173E25B2ADB265842E537C274E5468F16E532F4215B52D7DF422B82291FA73C23CBC35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtga.dll

Path C:\Program Files\World Machine Basic\imageformats\qtga.dll
Size 30KB
SHA256 5b641dec81aec1cf7ac0cce9fc067bb642fbd32da138a36e3bdac3bb5b36c37a
MD5 a913276fa25d2e6fd999940454c23093
SHA1 785b7bc7110218ec0e659c0e5ace9520aa451615
SHA512 cebe48e6e6c5cdf8fc339560751813b8de11d2471a3dab7d648df5b313d85735889d4e704e8eec0ad1084ab43be0ebdfbacd038aeac46d7a951efb3a7ce838eb
SSDEEP 768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
TLSH
T12CE25C6AD7790C82E52BA274E6928E0BD532F6205B22C7CF5255821D4F7B7C27C3C399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qtiff.dll

Path C:\Program Files\World Machine Basic\imageformats\qtiff.dll
Size 380KB
SHA256 825174429ced6b3dab18115dbc6c9da07bf5248c86ec1bd5c0dcaeca93b4c22d
MD5 9c0acf12d3d25384868dcd81c787f382
SHA1 c6e877aba3fb3d2f21d86be300e753e23bb0b74e
SHA512 45594fa3c5d7c4f26325927bb8d51b0b88e162e3f5e7b7f39a5d72437606383e9fdc8f83a77f814e45aff254914514ae52c1d840a6c7b98767f362ed3f4fc5bd
SSDEEP 6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
TLSH
T123847105DED049ABD876813456E7C612F3B3B4893F02CB9B9658B1343E027D125AB6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwbmp.dll

Path C:\Program Files\World Machine Basic\imageformats\qwbmp.dll
Size 29KB
SHA256 0f05969fb926a62a338782b32446ea3e28e4bfbffc0dbd25ed303fab3404abac
MD5 68919381e3c64e956d05863339f5c68c
SHA1 ce0a2ad1f1a46b61cb298cec5aa0b25ff2c12992
SHA512 6222a3818157f6bcd793291a6c0380ef8c6b93ecea2e0c9a767d9d9163461b541afaf8c6b21c5a020f01c95c6ee9b2b74b358ba18da120f520e87e24b20836aa
SSDEEP 768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
TLSH
T1DCD25B5AE76548D2E57ACB74E2D68A27DA32F1125722C7DF1266821C0F637C23C3C789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwebp.dll

Path C:\Program Files\World Machine Basic\imageformats\qwebp.dll
Size 498KB
SHA256 6e37acd0d357871f92b7fde7206c904c734caa02f94544df646957df8c4987af
MD5 308e4565c3c5646f9abd77885b07358e
SHA1 71cb8047a9ef0cdb3ee27428726cacd063bb95b7
SHA512 ffaeecfae097d5e9d1186522bd8d29c95ce48b87583624eb6d0d52bd19e36db2860a557e19f0a05847458605a9a540c2a9899d53d36a6b7fd5bf0ad86af88124
SSDEEP 12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
TLSH
T1F3B45B4ED5563788E56BD0B8DABD960BF6643C5C438085EB03D5F9392A33BC4663BB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\World Machine Basic\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 928B
SHA256 0e7e494b3422333d1cfe03d457d0aa06c3dd2344c9ddf93006eebf9178b13964
MD5 2bbaf04069b8aef840d252d149112a61
SHA1 c1d81b5c7cf1fee084d5bdd255f1d92d7ab6e2a8
SHA512 0eed571cbb4acce8eeaf0ddbefceed2268111677b0705dbec153ab6d953a207201e73168c4543a33b8ae42b61b1cf95d6f0cdea47c483539e04802742aa1f378
TLSH
T13B11F6619FE6501AF3FBBA3039F9121419BEB8120D31911D0081204A8F32B90DD24B26
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260718194629.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260718194629.log
Size 18KB
SHA256 6dc5ea62816268e4770abed10f1efef4717498a7987e6cd461a1dd3ab48c5d77
MD5 5a2dbb555bb8567eb481440ddc340acf
SHA1 7e24bf6c710dbdb64dc76c7840c9a1dd575e78ed
SHA512 742e2140334729905c85fc4970fe61fe86c0ad0916e4da8b048a744557dd09d898c03bb0959bb07d624bdb3d125b7de22c228ed8af3b37928bf3b6ca0f17c60d
SSDEEP 192:n7LWJEEn71I1W1F1B1m10171GHPHD3duW1MDqVIjNjLK8tqStUdDiSvqnLTJnfk:n7LWJva3duW1FIhHJKvqn3Jnfk
TLSH
T13B92105A6DB6A2E40DD0E3A5D0A19BE2C3E5B0553A0010A477F6436C931796FCFDBF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260718194629_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260718194629_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 d1cb8ce9976f67d9b1f2809631a5f1ec845a95a85907c2b56950ccf542f1409d
MD5 f0aeedadb2ebb6701dcd7a6aec284405
SHA1 5961923e1bceab7f0438a382e511b00a66fc3c1e
SHA512 daf78f4c284eb72fbe6f0093af52d2dc8a7af1a1643625f563d7248b559eb7c648d5ba06fa5fc1bd66109390a2ebb95de6b27c478aa4857c0e617d40d3fd3071
TLSH
T1F0414D651EE90917B1F35787AEF3C4225B33FCD56834CB0D2284831A02A7C05EC697BA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260718194629_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260718194629_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 a25605b6ce70fa6c6826fdb5e98ed084d5f6b55c0defcd3b2e87fc32b1510127
MD5 9c3b038ef08c4ac4431ca2165f33f43e
SHA1 99413e13dc273c033b8c2aedaf8f539ce00d30c2
SHA512 59a798bd82bf60dcc864c8bae352cef65bf38f450b5a468828ec8100911da9dbe0d6febea6398d32ba6ba21b9485613893e82218de1cad5dfbf182bb7dd0806c
TLSH
T11E4107651EE90807F1B397479EF3C8135B33FCC969349B4C2284831E0667D05E96976B
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsr2324.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\vc_redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Windows\System32\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Windows\System32\msvcp140_1.dll
Size 35KB
SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
MD5 2a214cb2f0f9473e7765ee3b8db8651e
SHA1 9ce5c3d6c7d94b175f136f552af8771dca6147b3
SHA512 ea9a759babdec5818fa1e430d1cb453cac762cfaa8f934e01d7182100f66cae21527962696f5bd963fcb0fba2c0f38bf4028e75f89e9e599ddee008021646a33
SSDEEP 384:3jJ2J9VQH+qNy09dmFWcS5gW7YZ1gr4iSt+e92xS+R9zWd/I1IHRN7SUl8BR9zTr:d8QH+qNy0PmgogU9v2ci9zeHSn9z3
TLSH
T1C3F25D86F7248442EC674970C699EE837C3DB3D25B50969B17A5F61C0DA33C1FA34A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Windows\System32\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Windows\System32\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{228B838D-BE5E-47D2-AB7B-28BF7531C29A}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{228B838D-BE5E-47D2-AB7B-28BF7531C29A}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{228B838D-BE5E-47D2-AB7B-28BF7531C29A}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{228B838D-BE5E-47D2-AB7B-28BF7531C29A}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{776F26B9-7211-41C2-A911-149D23F6526A}\.cr\vc_redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{EA724D89-7339-4928-810E-CDBF83A2B935}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-566-0x00007FFA56310000-0x00007FFA56CBA000-memory.dmp

Download

memory/2540-540-0x00007FF76BF80000-0x00007FF76CBF7000-memory.dmp

Download

memory/2540-542-0x00007FF76BF80000-0x00007FF76CBF7000-memory.dmp

Download

memory/2540-541-0x00007FFA5A8D0000-0x00007FFA5AE11000-memory.dmp

Download

memory/4560-496-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/4884-499-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/4940-498-0x0000000000550000-0x00000000005C7000-memory.dmp

Download