142c0cb75ea666873aa17b93543c8696071f19da87f41d462618f770b708c3a7

Analysis

user interaction
yes
max time kernel
108s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
next.exe
Size 47.4MB
Sample260804-xmervscl9v
SHA256 142c0cb75ea666873aa17b93543c8696071f19da87f41d462618f770b708c3a7
MD5 4bac343efc072e5c029739b3cfa0db06
SHA1 4f3810114b892494ce120bf67a639f9437f5f86c
SHA512 f7d4f5d39de765376dfba786eb57d3893049587dc6ea0ef74e45e333e40a908a9c58719ab96fb321d066965d88f0ceefc1e945b3d7a047995ba8bfe4dcc5e164
SSDEEP 786432:KiyFqDRNCxSjAe+sUGQUV79JOqqb2VmN+VzX/W86KMzG82bq26Xd6XhV/wVOugpa:KioARNCeAeg3UV7bOdbfN+VzPhxGG77y
TLSH
T180B7337FB28BA53EE06B1A7679B5E611083BB660B4069C06C7E8C85CDF254B11D3F643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	vc_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Executes dropped EXE 9 IoCs

pid	Process
4444	next.tmp
2956	vc_redist.x64.exe
4512	vc_redist.x64.exe
3868	VC_redist.x64.exe
3312	VC_redist.x64.exe
1128	VC_redist.x64.exe
4812	VC_redist.x64.exe
3812	VC_redist.x64.exe
704	next.exe

Loads dropped DLL 18 IoCs

pid	Process
4512	vc_redist.x64.exe
3308	VC_redist.x64.exe
4812	VC_redist.x64.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe
704	next.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c157798c-9519-4e56-98d9-f696f78f4a61} = "\"C:\\ProgramData\\Package Cache\\{c157798c-9519-4e56-98d9-f696f78f4a61}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{c157798c-9519-4e56-98d9-f696f78f4a61} = "\"C:\\ProgramData\\Package Cache\\{c157798c-9519-4e56-98d9-f696f78f4a61}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File created	C:\Program Files\NEXT+\is-6AKIEOOFAG.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\icons\is-M1PJTJ7F4Z.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\fonts\is-OMQC11XNDK.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\unins000.dat	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-XFZDUK1TR4.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-2X6BCX46RS.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-Z7061UWHI1.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\libmpv-2.dll	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\icons\is-ER6LL6FPPU.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\volume_controller_plugin.dll	next.tmp
File created	C:\Program Files\NEXT+\is-ZGZCW1GFAV.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-HSLHBWD57B.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\is-NT5GZX7E20.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\icons\is-R5XWGWELY4.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-ZIAUEY9P8O.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-G55XH5T9XE.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-OX4YIXFSNM.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-ZJX35PVBUD.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-XO3GVHOTOC.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\flutter_windows.dll	next.tmp
File opened for modification	C:\Program Files\NEXT+\next.exe	next.tmp
File created	C:\Program Files\NEXT+\is-8IXAZNO1WW.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\icons\is-57FZ03II2N.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\packages\media_kit\assets\web\is-FPFC6W83E0.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\screen_retriever_windows_plugin.dll	next.tmp
File opened for modification	C:\Program Files\NEXT+\sqlite3_flutter_libs_plugin.dll	next.tmp
File created	C:\Program Files\NEXT+\is-SGVNTLBGZO.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\is-7NJFT6YF6Z.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\is-F881AYMMJT.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\d3dcompiler_47.dll	next.tmp
File opened for modification	C:\Program Files\NEXT+\zlib.dll	next.tmp
File created	C:\Program Files\NEXT+\is-EZ5SSNZBPJ.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\packages\cupertino_icons\assets\is-R33CPND8IK.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\sqlite3.dll	next.tmp
File created	C:\Program Files\NEXT+\is-16T92YLF3F.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-USXR3H8P74.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-8NZXYKQN00.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-9CBG1ZA39B.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-JTYZVUBF4B.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\media_kit_libs_windows_video_plugin.dll	next.tmp
File opened for modification	C:\Program Files\NEXT+\libGLESv2.dll	next.tmp
File created	C:\Program Files\NEXT+\is-WSWA66FXCW.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\is-EATAHL08ZZ.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\vk_swiftshader.dll	next.tmp
File created	C:\Program Files\NEXT+\is-LAGNB1U7X6.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\libEGL.dll	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\is-WHONQPU5G6.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\shaders\is-L1AB696TPG.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\window_manager_plugin.dll	next.tmp
File created	C:\Program Files\NEXT+\is-6YDJ3ONQM9.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-C6IV2S9FDD.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\media_kit_video_plugin.dll	next.tmp
File created	C:\Program Files\NEXT+\is-5KSLWADYH8.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\icons\is-AP2VNRBA0L.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\assets\images\is-NBIZCJ8QR6.tmp	next.tmp
File opened for modification	C:\Program Files\NEXT+\vulkan-1.dll	next.tmp
File created	C:\Program Files\NEXT+\unins000.dat	next.tmp
File created	C:\Program Files\NEXT+\is-JMYT6V70P5.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\packages\wakelock_plus\assets\is-AME8L4YSDT.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\shaders\is-I0HRWZ6G08.tmp	next.tmp
File created	C:\Program Files\NEXT+\is-YTBVANAMRL.tmp	next.tmp
File created	C:\Program Files\NEXT+\data\flutter_assets\is-Q1T49IH7S4.tmp	next.tmp

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58953a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7AB1994C-7537-46A5-84BE-A3E090AE982C}	msiexec.exe
File opened for modification	C:\Windows\Installer\e589527.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e58953a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA391.tmp	msiexec.exe
File created	C:\Windows\Installer\e589527.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9805.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5937353B-6E8B-4A29-806F-366A8748E276}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B81.tmp	msiexec.exe
File created	C:\Windows\Installer\e589539.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0D1.tmp	msiexec.exe
File created	C:\Windows\Installer\e58954f.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	next.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	next.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3700-0-0x00000000000B0000-0x000000000018C000-memory.dmp	innosetup
behavioral1/memory/3700-20-0x00000000000B0000-0x000000000018C000-memory.dmp	innosetup
behavioral1/memory/3700-361-0x00000000000B0000-0x000000000018C000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7AB1994C-7537-46A5-84BE-A3E090AE982C}v14.51.36231\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Dependents\{c157798c-9519-4e56-98d9-f696f78f4a61}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.51.36231"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\PackageCode = "DFC528C2D494E8B48B778E012DB3FD11"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3537395B8E692A408F663A678842E67\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4991BA773575A6448EB3A0E09EA89C2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{c157798c-9519-4e56-98d9-f696f78f4a61}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\ = "{c157798c-9519-4e56-98d9-f696f78f4a61}"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36231"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5937353B-6E8B-4A29-806F-366A8748E276}v14.51.36231\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4991BA773575A6448EB3A0E09EA89C2\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\PackageCode = "12BD6E398F00C1344A275B4C312B9C62"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3537395B8E692A408F663A678842E67	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{c157798c-9519-4e56-98d9-f696f78f4a61}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.51.36231"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C4991BA773575A6448EB3A0E09EA89C2\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\C4991BA773575A6448EB3A0E09EA89C2	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B3537395B8E692A408F663A678842E67\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\Version = "238259591"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.51.36231"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\Version = "238259591"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B3537395B8E692A408F663A678842E67\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{5937353B-6E8B-4A29-806F-366A8748E276}v14.51.36231\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{7AB1994C-7537-46A5-84BE-A3E090AE982C}v14.51.36231\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Dependents	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C4991BA773575A6448EB3A0E09EA89C2\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\Version = "14.51.36231.0"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.51,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.51.36231"	VC_redist.x64.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4444	next.tmp
4444	next.tmp
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe
1124	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	4244	vssvc.exe
Token: SeRestorePrivilege	4244	vssvc.exe
Token: SeAuditPrivilege	4244	vssvc.exe
Token: SeShutdownPrivilege	3868	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3868	VC_redist.x64.exe
Token: SeSecurityPrivilege	1124	msiexec.exe
Token: SeCreateTokenPrivilege	3868	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	3868	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	3868	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	3868	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	3868	VC_redist.x64.exe
Token: SeTcbPrivilege	3868	VC_redist.x64.exe
Token: SeSecurityPrivilege	3868	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	3868	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	3868	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	3868	VC_redist.x64.exe
Token: SeSystemtimePrivilege	3868	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	3868	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	3868	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	3868	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	3868	VC_redist.x64.exe
Token: SeBackupPrivilege	3868	VC_redist.x64.exe
Token: SeRestorePrivilege	3868	VC_redist.x64.exe
Token: SeShutdownPrivilege	3868	VC_redist.x64.exe
Token: SeDebugPrivilege	3868	VC_redist.x64.exe
Token: SeAuditPrivilege	3868	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	3868	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	3868	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	3868	VC_redist.x64.exe
Token: SeUndockPrivilege	3868	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	3868	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	3868	VC_redist.x64.exe
Token: SeManageVolumePrivilege	3868	VC_redist.x64.exe
Token: SeImpersonatePrivilege	3868	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	3868	VC_redist.x64.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe
Token: SeTakeOwnershipPrivilege	1124	msiexec.exe
Token: SeRestorePrivilege	1124	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4444	next.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4444	next.tmp
704	next.exe
704	next.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4444	3700	next.exe	85
PID 4444 wrote to memory of 2956	4444	next.tmp	87
PID 2956 wrote to memory of 4512	2956	vc_redist.x64.exe	88
PID 4512 wrote to memory of 3868	4512	vc_redist.x64.exe	90
PID 3312 wrote to memory of 1128	3312	VC_redist.x64.exe	102
PID 1128 wrote to memory of 4812	1128	VC_redist.x64.exe	103
PID 3868 wrote to memory of 756	3868	VC_redist.x64.exe	108
PID 756 wrote to memory of 3308	756	VC_redist.x64.exe	109
PID 3308 wrote to memory of 788	3308	VC_redist.x64.exe	110
PID 4812 wrote to memory of 3812	4812	VC_redist.x64.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\next.exe
"C:\Users\Admin\AppData\Local\Temp\next.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\is-9M4GTO31AA.tmp\next.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9M4GTO31AA.tmp\next.tmp" /SL5="$60202,48262374,842240,C:\Users\Admin\AppData\Local\Temp\next.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\is-5AHSSAJNFE.tmp\vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-5AHSSAJNFE.tmp\vc_redist.x64.exe" /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\Temp\{98241821-DCF5-4CF1-8297-19B078B7FE09}\.cr\vc_redist.x64.exe
      "C:\Windows\Temp\{98241821-DCF5-4CF1-8297-19B078B7FE09}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-5AHSSAJNFE.tmp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{329C2388-52C4-474C-8E10-64B18FE0DC4F} {A2128A3B-7A09-409D-AF90-E92A57C0C9F2} 4512
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1176 -burn.embedded BurnPipe.{E3B64C05-2A85-45DF-A06F-8A9060EBF952} {44887CEE-A490-4E10-9128-0CA3963BA932} 3868
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c157798c-9519-4e56-98d9-f696f78f4a61} -burn.filehandle.self=1176 -burn.embedded BurnPipe.{E3B64C05-2A85-45DF-A06F-8A9060EBF952} {44887CEE-A490-4E10-9128-0CA3963BA932} 3868
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{655FD003-A4BC-49D1-8674-6515DAF38782} {5FC131C4-D879-4D0E-890B-1FD4F8279ECA} 3308
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3652

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195830.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195830.log" /install
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{94BFFFB2-4A34-45F7-A40F-ACB27DB55AB9} {86E32D11-F651-4010-BDC0-9923CF8B23DA} 4812
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:3812

C:\Program Files\NEXT+\next.exe
"C:\Program Files\NEXT+\next.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58952c.rbs

Path C:\Config.Msi\e58952c.rbs
Size 19KB
SHA256 ac34776b307fd9cd896c80f18979255fd222ddb7df8be3abd9babe3ad3e277ad
MD5 43357abc2ccc1cf99f398edbff29b7a5
SHA1 4e5c650309bff5198811884729df982ee4095e9d
SHA512 4358c94aa7c369dfd851caffe0ce7a2516f25c96d00e7c91ee34cab4661805d8e826f81d21c42f6c8fa18a3dece7d59c40f331219fb6152a1e1459d672ae12be
SSDEEP 192:OtRl1kR815dXcFUADIc1L+W+y4+agPuoL7:OtRl6R8TeC81L/c0L7
TLSH
T162920C02A690C9D2D8766B70CD635FA53B76DBD5A350438B50DC90308F93BCA2F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589538.rbs

Path C:\Config.Msi\e589538.rbs
Size 19KB
SHA256 e8298cae4991efaa97ff284480389460e6c78698accc8953d71093bbd363cfb5
MD5 927292e3368250232f65100222c507b2
SHA1 4f97905a5f056e8f5ecb8455337ff2bba2c22dd8
SHA512 ee356934a119fb6d0207adb681c85ae4ee7d872ebb8600c2989b0e03104b7175c863a4246802adda483661c920822cc93d1d37d917cd429c783134c27210d1eb
SSDEEP 192:OlKTgY5bpW+cr1+7QTPiVJUagnkgeEJrzgeI+geeOJDEvf5jMpI:OigY5bpWdr1+7QTP++n7Jfg8gDLr
TLSH
T14F92DA827A40D6C3D8A62B30DE572B1533BAD7EB9351535B40CCC4708E933CA6F9E64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58953f.rbs

Path C:\Config.Msi\e58953f.rbs
Size 21KB
SHA256 3f0a86bf7411b089d4c4c9eada65ab11e8dd278121403dc0a5f734dac4873f11
MD5 a15cfd3c45d7bb9f7deb6ae8c3061434
SHA1 9224bef62c9c6c14327e37915196fcf5725fb34b
SHA512 9b299223e71643fe790f4f066a10a40c39fde6efb63b9c82c151a4d54e83336df17ee847067b5a0f5c991540f4938cb4274199c4b47ddcb9097938644aca33f7
SSDEEP 384:brRKGR1nAKxNAUhUC7xJjrMNYPVIbS/4SydkkrQjQ9TkP:bFLJAKhCsP
TLSH
T148A21F43768099E3C8A227B1DD671BA53B73D7D99350434B10ACD2348F633C72E9AA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58954e.rbs

Path C:\Config.Msi\e58954e.rbs
Size 21KB
SHA256 869979bbacb9085c482600ed0de9256512f2e1153172df52a89ed1455fde4dee
MD5 32f08b008979f5a101f2628aebbba1bc
SHA1 bc0ffdfd499be1104a8b2a2d1bd56f8722e04a5d
SHA512 987969b502bbbe4abfdb715525b9e4497873dbe93b3deae23b28cbd9b1aaac0e9ef0f80f68deab4a3d4b00cd31c8c382440830af6f0884c15068be4e59d7d2c0
SSDEEP 384:bXxOWfHiL3lp3YejA4k5P8salckU72eC6kfUGeUftcCcd4tAx0:bXxOWfHiL3lp3YeMR5PSfUGeUV/24tI0
TLSH
T13AA20F02B900D693D4A61F70CE9B1B543B76D3DA9362534B02CCD1709FA33D66F9E58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Program Files\NEXT+\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\NEXT+\data\app.so
Size 8.3MB
SHA256 dd93194bf8eee1d0b6480ffa97a13c9ac281df5c16b1122060efae934a15391d
MD5 67c78bb4faea8135e9c2f79b2ccc5795
SHA1 9c31d3c956f8b300c1cad7bbea382facbec0f896
SHA512 f0a689e5e40dd68e6050edf788a37d788eeed68c4e45063a29360288af50384e56641ef5399fedc8e51530ab5362962c36f8f7794d61136481eebe823614f2b2
SSDEEP 98304:Mcy7IwbZhq6h5yYn/YBa450afb4PClBOOB0KyD8q8:MbISq6h5yYn/YBa45vfUPCl4Pwq8
TLSH
T154960997C1E88360D432EB72F75F2AA29E1439CC5E71B74A069857153D9BDE04ACF232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Program Files\NEXT+\data\flutter_assets\AssetManifest.bin
Size 1KB
SHA256 fb99447e1277f717e55ed09862906113deab66d0343904e7a821b07f3d463ee1
MD5 7e950e1add85ede52048e5a8a67f9f5f
SHA1 059c80f679d106023f4d16c56c9b9866cb7446e6
SHA512 641248461334f9a99d61cee4f9ccff79db57bc457f0d248c1bcb6ee929f09884ce700c90d230e719552323809e925c0a3de55eb9c1a2675b5b9fd9c062f5bb67
TLSH
T1A8212E18422865CF2E44342468AB11EA6E075F54C804E7EE3778C91AF0E5A652CFFD71
MD5 SHA1 SHA512 TLSH

Submit Download

FontManifest.json

Path C:\Program Files\NEXT+\data\flutter_assets\FontManifest.json
Size 208B
SHA256 cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
MD5 dc3d03800ccca4601324923c0b1d6d57
SHA1 bca264548730f8b1871672891b0ad0c02444bfaf
SHA512 eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
TLSH
T106D0C74B581909F6458D9845F0E11253BC4429579E46DCCDE3A40E54D3A11641739213
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\NEXT+\data\flutter_assets\NativeAssetsManifest.json
Size 131B
SHA256 4ac70f7d67abb2ffc105d2cabfdee68c9aa138d132107e5be4949c539f7ce379
MD5 93fd9d2b0d844c5bddd73c3ae2973328
SHA1 73aea486854647bc6c20f32a4df178e36eb39643
SHA512 8c0815974fd8fc1a2dfd12c05c5100d07bad5fe4126577b590e910bdf492e5acde0055deaeac357a1470dff9a279453d1cbed9eeb41b959604c2e9c0b5cc8242
TLSH
T14DC02B9681000B6134C85705E8090BC0015D3310E8721C9C05E0410C0F0050EC1100B0
MD5 SHA1 SHA512 TLSH

Submit Download

bg_splash.png

Path C:\Program Files\NEXT+\data\flutter_assets\assets\images\bg_splash.png
Size 60KB
SHA256 abd1be4fcc3b1c82ca8798f8b36d92d81a9019bcd25f2467ffefa698fe66771f
MD5 59d8216814030f42096bdb22cbdf3c8a
SHA1 17f3a72a80b54c1225b010f04ac19d02ce83f68e
SHA512 52dcef49163d1e84cfe9b8b821cbbd7407cbc5c6de2bdef28c8e458743c286fab5cf82f90ce9009c1bc2ebe56f1603182696ea15b163df342c8b178f6eca789f
SSDEEP 768:AmKroOooWooij2a7jT8ucVGPAbueFeeeeeeEm:AWa3lcVGAb
TLSH
T10853F043B9054B4DAA89B3EC578CD960447CDD47EB44405CA394EE830FA758AAB3E73B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\NEXT+\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\NEXT+\flutter_windows.dll
Size 20.3MB
SHA256 3168c546aeb0b0e6a77abc97e0de95b45d13ada150faaad6de75e79acaf3b050
MD5 28ec57291294e97b09b438bb5d09b91a
SHA1 b550a20ae0539c0015caca58d1a3cae4193c0fe2
SHA512 0ab8f5f70af3e14fc4e070d3429199884856f1c63993c867fadb2ab50435747d2716e5a5f4531b6eda6bd4aa5e9d57b81e3da7e744843bc3cfa0996840e5d8ab
SSDEEP 196608:KoFEhlGs2y2dQCy/d0rgrCNhe8ZzidTz:KoFEPVzt/d0eCNhXZOt
TLSH
T1C8277C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files\NEXT+\libEGL.dll
Size 461KB
SHA256 b2590bd0692f0381fc45c20bf1c7f7f713c9ea19c7ea6bab62efdd1fadc4eaac
MD5 0f61da7cea39e89861117f3cb4620dae
SHA1 9ca286bf6d5617eb38101d5e166edac29497c9c5
SHA512 7dc2bbce9808e00122ae0d960ad6b0156d201494aedf4c4c9e261f50986b72dd19b41d443138ffdf1b2e5b8e29614f0a1e909e4c867262eab311f6675618369d
SSDEEP 6144:bAJGuTlLMP/jvtG0uMgvgZS+U85p+2uEA3sB9KeZTyT/tSOaj0yPepA9YK9f:oTaP/jvtG0urvgZS724sBbj0ZS7
TLSH
T156A48D15B79448A9D02AC074CA538643EA72B8960F64FADF13A0D37D1F777E85B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files\NEXT+\libGLESv2.dll
Size 7.1MB
SHA256 620bb6e38d7ed6c760a0cf4a8eb6a8f64b259b96ff286551cd32cefc6c35ca39
MD5 d22c92bee4e7a14d6c74e7376eca7605
SHA1 0592d72d5e0e38e5cfd9a090309260962bf8c4d9
SHA512 2aeec8ccf9db442a2b1e3b391e6c3e899de1266199e6ee6040aceeaf8931e1d10c55ea1ab9ebbd3cc662bf56aea698c09e38f75c7b3e8b0b27c02af63d36993f
SSDEEP 49152:fR1vq8X1ZxC721Mr+IqizQ0LQj7KxKT1wvIOCaDCmvWI2YQkGk6jouaLlbpx/fur:b/xO21eqnoIw+vknAYYszpuSxxZi8Y1
TLSH
T142765A03F69141EAD05DD2B98B5B9622F231BC861371B6DF229473153F76BE0AB3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmpv-2.dll

Path C:\Program Files\NEXT+\libmpv-2.dll
Size 28.4MB
SHA256 d5f0694b08c124e785d858d00082f3e3b158dd9138bfc48c0382bf1eb443a5fc
MD5 3a6bd0dc9ab32d7b450f06bca2359274
SHA1 b2be6a73be23b60f1d23543363ea559438218c72
SHA512 4c8133321833bc94c8a2f1ddc83523fd554d9699efa09d8dea6ef4aa9bbca0a4f041a10e4793b6424c8cffc4583e36c2a96039017f29465458a9a2e5510631ef
SSDEEP 196608:2E4MJL6OGzrpR79PnKPBv00IbW8p6NMA+31bGb34+1VVMjbCtuQ/OHAs4:CMMOap19/KPR0Zz50I+5Mjbou4Eb4
TLSH
T116676D07E29350ACC56BC170876AE733A631785D02B47A7F2695E7B02F22F90775EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_libs_windows_video_plugin.dll

Path C:\Program Files\NEXT+\media_kit_libs_windows_video_plugin.dll
Size 12KB
SHA256 83f8da5c1e06e7ea67c6a7b58a2cd9e919585d8ceeea29cecbb4920a44bd67d4
MD5 bb539f6c5d08540750c6f7248cfae948
SHA1 062b64b558d54c53bdd1658507d1ebfd48d6235e
SHA512 ff7aac63ccf2a5e1b387bb8da24a74ec8eea783993974b19e523c725f78e8fc873dbd45ddd035b3ba9c2827aca51344adbbe491b239b708b255c6c9168266b25
SSDEEP 192:RJne0nlt6FFhblNAR5g8zG2fgnyKYSAvX2TrWDty6yfYQgDJSjOOB:nne0nT6Fr+tfgn5YW
TLSH
T13442E7867BA50DDAD66543B490530F08C376F9389722678F53E1D05B1FAB3C1786FA81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_video_plugin.dll

Path C:\Program Files\NEXT+\media_kit_video_plugin.dll
Size 147KB
SHA256 0ae3be1e1fed1d422d3ccd978c0a4919977d11769dbe17c862d80bd4dbbc881a
MD5 64d1ef13a937bfcb4a0c4d630ffee25b
SHA1 69b418c8ae36d49a7b275e62ea336c5f22f69e7a
SHA512 52067b912b8ab059f9f9f96ac4fb60c56ad4ef04baa618d49dae2b9f8e1af0a4fb9c5151f0cb0c8336b82fae7d4b6e1ef84b122465e706034e08bfbb0ed8914e
SSDEEP 3072:HV1DxuxjiWuxoCTk6WeHT/af/V6OXRE5FqtGLlPUHUb:zDxUjUTk6WeHT/+BE5FqtGLlPUHU
TLSH
T1B8E34B2BB62D00A6D266C07DCD534956FB72B8814791A7CF17A10BEA1F17FE85E3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

next.exe

Path C:\Program Files\NEXT+\next.exe
Size 740KB
SHA256 afce87c6572db86c50479983560e9aeb6fb516afc1f67b08447c997183ea1195
MD5 a2f929b394881e35ae3c51806c00dbc0
SHA1 982f5db3775886508532d0446531c1bbd0c76a95
SHA512 fec1fb72602e5771c0cc8d39f41f787f92eecccd40cf6f16f21ea3da4ec36d707e399285dd2acf13cc3bae960b5031a8819cce22c8aee3442fc53849826c1681
SSDEEP 12288:MQ6eFX1dHcl4DlZlwYaQ7zdk2gWJaH6VdTjPEUzMZJ0O5rQd2uB:MQ6wfhZlwYaQ75rgWUH6zTjZzMZJ0O5M
TLSH
T16EF46C5B666802ECD1BBD2B8C6575D62F776B8060361DBCF17E08AA32F436944F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\NEXT+\screen_retriever_windows_plugin.dll
Size 116KB
SHA256 1d5ef8447e4a95d028ec9069fb894f6e106378632cac1d2c2bb3be41cccda037
MD5 2517f7e2cbfbb0444ca46bde3d3c2efc
SHA1 a1b43768648385c5175c2326922c8584954237bb
SHA512 7268c45ef592b98ea9ee7d22453a9fa85312a91392290e269fd9040ac66d88c19d07d62f235e72b5576c0b5fd915a90d1f7b08983737d3fb105d3e415a7da3cf
SSDEEP 1536:fsILOR6ScJJsKeRcz06Z7xS+kY3hhrSoqz1wKnp5AuZCRAOSHvD:fDOcOw063KqGoqvp5AuZCRAOs
TLSH
T1B2C33C2BF75940A7D26AC4B9C9438D46DB72B8914791A7CF57900A9B0F27BE84F3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3_flutter_libs_plugin.dll

Path C:\Program Files\NEXT+\sqlite3_flutter_libs_plugin.dll
Size 9KB
SHA256 b512173fcb6a6c12a41273c396121686a5ed160d4d9bfdd9f91b423479736b43
MD5 7cb9a451360cc8f1f26eca09ff6eb55c
SHA1 64c525701a671dca6af4cfc1db0468497b124c26
SHA512 b99585b601cbb6db9704130f361af90883217e51708c073315f36baa393eca0ff31e1903ed32e3863935063ed454441163c64465d28b0cf00cf516351914eccf
SSDEEP 96:UqQ5dVJz5NfCPYFibwJM81ABUAzyti9X3jaCpo/VK0tXGyMoQgCRhZx:Uz/JznMk1WvnWCpo/80tW+Qg2
TLSH
T15712F949F6548ADDF929C1B4C5274F49A17AFB20032123CB23B4A17F0E67797E13BA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volume_controller_plugin.dll

Path C:\Program Files\NEXT+\volume_controller_plugin.dll
Size 94KB
SHA256 011759aaa918591b152484c610cec5b1288ea64eeb7902ef7b05bb0112ea0655
MD5 37e60c460a5bfac44a3721af84116ce7
SHA1 4162fb47399d62c5c3ddb808167e31c5901b1723
SHA512 936e7ef8c9e3ef9028511759fefa48910ba4760dd5e2a6a12025fc16c19066e12ae8872bc749145b597f8b9cd306473adf4e7103692a60d902eba357a0093980
SSDEEP 1536:IuakveQBTTky6LNNxTtAGw5l8qiQ5riWE/S:pnbBt6RDOP8qiQ5riWE/S
TLSH
T198933C3BAA5900A7D21AC5BCCE534D45DBB2F88547A1A7CF1B500EDB0F17AE84E3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\NEXT+\window_manager_plugin.dll
Size 127KB
SHA256 52605fe53da116189c14e9b750426926cfc93afaf4554ed4f4dc5f9616798f21
MD5 f4b292d3b9d7f91ebb01bb12ca4b2796
SHA1 507ef91be4b1107e2ae0ed8d84be2abf9693799f
SHA512 d134d860c826d97d75b2bf7efefff49b27b17aa1bde350c2fd7040fdecb296633b68c2801e345eaceed66b42f91c817ce43fe6517a9e5d6d8595fa2e0965a4aa
SSDEEP 3072:O8CLcqRAjdPnX6CQ9H0TStP0woAPAsygzTYKbIe:TCgqRAjdP6CQ1ZPAsygzTYKbI
TLSH
T19DD34D2BF75900ABD16AD4B8CD438946DF72B8854B91A7CF07904A9B1F27BE41E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\state.rsm
Size 992B
SHA256 edb87ae7e6ff67d8261f08718121136987e7220c56998b0a999239cb3cdc8da8
MD5 da6da15704ab189063096a53d7a83104
SHA1 b65feace1a6e08acf9986df97263eda173f614df
SHA512 641f583e8ed6507a02e965f9cb1f9d86c03b651d9d9392454a335d6f3571f088eac73f92c07b6c45c35acb9338ab6ecd5c5d39292ef8cb69e4a6cc994b73c6ba
TLSH
T1CE11D160AFF6501AF3FBAB303DF9021459BEB8115D21D51D0081618E8E32A40DD24B2A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260804195830_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195830_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 e421055bfc9c54c19e4be919d3471853cdf8c6587706392c2b05003c57233942
MD5 94be3121b215b29f8dca4ae2e9e037ae
SHA1 a86bfa3660abadaa14c73a001a75394abef2f32c
SHA512 3679df05c4bd43c075e0ad6254db993e5af399fb3be23336740d4ae7ff8aed124e2d5497e749913f8a9e42b553caf87237657208c83e0d658801a420560b1f9d
TLSH
T1164104902EE90815B1F75747DEF3C4526B33FCDA69309B0C6245821A06ABC06AD7C76E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260804195830_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260804195830_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 876eabf2ca0ee2890f0141c77810eb7ad4660e83b74422fcaed886cb9e987b65
MD5 c794e99f5c842eb536925a8a9852f016
SHA1 7a71f514e28124a2390238aaf37c3fad062a6418
SHA512 1f6d1cee9eab4015dffc8f9832c8499cc6a63abb6615d34f31e6da1eddd9c0db82198da7f8a3b4c4484c130b41c21d6a249bbd6db866534a61a768cd5a9940c6
TLSH
T1C44104641FD81815F1B75787DEF7C4516A33FCD6A8309F0C2384C21906ABD06A96C7AE
MD5 SHA1 SHA512 TLSH

Submit Download

vc_redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-5AHSSAJNFE.tmp\vc_redist.x64.exe
Size 17.9MB
SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
MD5 bb2063bbfe319d17b18d8f506efb9b8d
SHA1 6e6012844d636aa7b28067554d6fd0bfda393097
SHA512 3dece58f72ddcb2574c33bd4cc41fde8b4304c5bc0a9e6a0cf9eb9e095a389f5659462475ab366a6d8a6820999fd5f03ab17f865c921c481632b236a05ee5b35
SSDEEP 393216:P6C6pMxhgFCXoBX7Zw9XI3+8pQT4zLk5yn2mZfkjhQEHUf/:P6C6OxOFCXop7Zw943+S3kgnfaUf/
TLSH
T106173333A4224177F7B104B3A528E3703E7CB3186B5999B9C7C8FD483A64491A6BF617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

next.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-9M4GTO31AA.tmp\next.tmp
Size 4.7MB
SHA256 bb2c9ced8fa7e12d6961b3f7f66bf982cf46b5dee5282b046f47d7cabdbfe74a
MD5 0b4074fc2c993612e71904da3bd8449e
SHA1 174f3ea7237e9e28ff113f3a3e69a3f83b549489
SHA512 ca56f54cb966f274c22b3818bc527fa96b15afb9fd1e72e41493d293944547d8afeec0f4dad8093c9b693a8328ae1561d9324c0bb8266aed009dd709452afd01
SSDEEP 98304:wvdHRh7Vhv2Wn+FYGa7xP2gRQJhLmC333p333K:iHLn+eHNt0I
TLSH
T1BD369E23B384A53ED4671E3A687FA649583FBA203A168D476BF40D5C4F396402D3A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Windows\System32\msvcp140.dll
Size 627KB
SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
MD5 6d318c1ba915d3d87f3f59dc6e3de276
SHA1 6da14daeaf9cf2c20670e83a37c393a94bb4e557
SHA512 b9ef17cc2ad61807b68d6b80ea8f084c2fa6d422aa73c455017d0992d35dd6f8d284d2a2ffabbf88fe97fc67f7684141a0e685675c017211e9d1327f22031ff7
SSDEEP 12288:0HyzMcAOctv6pOFoUn0uXptkQpytoJgweiQKW5mUeSOjHWtCje8ACU5bwfDwK4vh:0HyINNkQpyHbApTDwFvHPQEKZm+jWodK
TLSH
T187D41823774D02A0D195E2B9A1C74306E7F1BC464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Windows\System32\vcruntime140.dll
Size 174KB
SHA256 19c293ac482fdb882cd29d2b0e6d807419efdcada04068f03e5723670895e17d
MD5 2e79fe92ea9d573266021a1e0a9b17d3
SHA1 ddd96f94427ec7a1a43b1ce2eca79a8383ca2457
SHA512 bd68c5940f8f0756dec6390b4e8020b2a75ce996338e2f7de72b656d91396e22b7b8b0cd0d06bc0962b25aa7d892cf94c17a2229c48405d66d769b9c776f22fe
SSDEEP 3072:0Qf3XYZst/GrhA4gBSnSX3DQj0yeBrZHecbxvWjVWk:0QPYZsmBnSX3dyeBrZHecbxejt
TLSH
T1A6048D51B2CC00B2E52B86748CD6D953D6B5B0057B306ADF47A886782F33FF2A63DA05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Windows\System32\vcruntime140_1.dll
Size 49KB
SHA256 a253a12e4a8e9e23ebfe0ced829f7751e4f42c60066986bf20515ced8dcc68cd
MD5 0e8274882579fd2cb2b4028d0847e5e4
SHA1 6359a51dd137998b579dc66876ff4e7abaf0cd7a
SHA512 8a84b7ceb1d9ae2136b2cf4a2ef8fbe16324a3976597f7025ac9f86210f47c95627ce812ad69307b9fc86418aee41e6354544a324d3f0a7b3773dde49b6a9662
SSDEEP 768:Vmhyc193JS7ySK0TAinfw4DYlrjZ9z0+Xnarr9zEJeui+:vcjZ0y6/fgpzpXGBz9+
TLSH
T1CB334B8497BC4086D8A798B081AAEF07BE3DB762575052DF4EA0E55C2D537C0E73C22A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{69305816-5DE1-4194-9E44-C4F7A980AD77}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{69305816-5DE1-4194-9E44-C4F7A980AD77}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{69305816-5DE1-4194-9E44-C4F7A980AD77}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{69305816-5DE1-4194-9E44-C4F7A980AD77}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_redist.x64.exe

Path C:\Windows\Temp\{98241821-DCF5-4CF1-8297-19B078B7FE09}\.cr\vc_redist.x64.exe
Size 669KB
SHA256 7cdf942ae5869c0ee2fcc94db84c4999eb0b97801b291e74f61ebb8fe3925905
MD5 1f81dea26ccde986ebe855b6af848a58
SHA1 1dd89a952971294fd8d5008386442f0845c6f1a3
SHA512 298011b045f478d3e9397163a12141c21ab2e4aecd4cc3926f4fb4b0e25f10fb9e5ac18e0ffb61b256463dc8ed44bed9c1abe5463f354836b0a5ac154422e247
SSDEEP 12288:a3mgqnIZuYfCYqFet4CovkM7Ka1nEnutj2pSrt2pD:a3WnIZuMCxezot7nhj52+t2pD
TLSH
T1CBE49D32A5614033E7F10573B928A6303E7CE7282B51C9A9D7D4BD1D7EA88C1A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 718a88535f7bc81804646088ac4bfe70a888ed45fd0c130bc625ff9eaddd47c0
MD5 5b1c68af3e5db4b822db9b9124c02781
SHA1 26c9c7f864f063167670e77d5ef08c8e265ab16b
SHA512 45fdbb054afe1dcdb4a5bf78ec418474a22f4154f5a06bbb2682ba81260bb048645c8e2408d239162bbd97f1e829ed67afd742a338d8f25316b676f2cf9bd131
SSDEEP 98304:md0ZdEXRDi2NN5Y9RvyYPk9LqmN/RjatXHRHzu4MbXpjhFV3nvwKJQbbDb+:md0fE82NnyPk4IRjuE4MbXpjt3YKJQbS
TLSH
T136463396D8A7647BF02A18EAC55597C364E0231EBA6F35278F0DFFA04046452AF7DC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\cab5046A8AB272BF37297BB7928664C9503
Size 1.0MB
SHA256 99fda37db1ad396ca1049cf83e3ea5cb60c7aae315f4b94efc599c26bd54839b
MD5 750c6a47699442ef2223d4ab753aff43
SHA1 41feb08dbe3b56b156def2d6cbcb9064ebf28702
SHA512 b8c9ad085ba33a7a7061397b1d2449bc6918f3e8ea996436a88dceea3359ec1dc628b7333ccaa74effc30779c538ebcfa8929ef780108009c11d8f33a5c7e4e9
SSDEEP 24576:E+x/4/TEBtRi8fJXyQaGG9wpcfnARBZ33Jr+MoO:E+x/4/IBtR9fJXyxhPfn6B+LO
TLSH
T163253355B621C886F7B6089417D4D7F626E129DEEEFAE61C4BD114DCCB32E81032BCA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\vcRuntimeAdditional_x64
Size 208KB
SHA256 26d8f51e4683411633d7c45999fa948f33322b5728f06ff2242df06f0c63e695
MD5 f980ea6dace614530e26cb0129748905
SHA1 11353d78be478e19e0ec85dfc11ca309dd330b02
SHA512 a858b11319dbed350dfb26f88bfb97176f1f4a34a12cb2e2426fcdfa91df2cde57a525abe261808422be7313e44af659e0708b657befdde6609a6dcf0c30f9ee
SSDEEP 3072:N9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTMDR4Q:HlaZeKFxCnBheIdluwDF
TLSH
T13E24AE12B5808033DAFE1A310578DB615F3DBE608F544A9B6364B6AD1E717C08F36AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{FC86EA7E-AD8C-48EB-9F4C-1AEB3E16CDA1}\vcRuntimeMinimum_x64
Size 208KB
SHA256 96ce3adfe6955fa343aeb5d1bdfe3a7c3936de75d0df74147074e4899f27f42f
MD5 7c34ab619555f11c18e9284d63074151
SHA1 bee7a407ca72561a7280edad4c28134fe3f87a08
SHA512 63dd09fe5cfcbdccdc42a2eaf0c99940bca80f11abf3cee7b6454b9b018a2317e2e3926567cfec3a3a5fa1f47d7a5e9c0007be1315239a81c71220fd882c211b
SSDEEP 3072:a9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT0jg:klaZeKFxCnBheIdlug
TLSH
T11D24AF12B5808033DAFE1A311178DB615F3D7E608E544A9B6364B6AD1E717C0CF3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-400-0x0000020DFBD00000-0x0000020DFBD80000-memory.dmp

Download

memory/704-392-0x0000020DF97C0000-0x0000020DF97C1000-memory.dmp

Download

memory/704-405-0x0000020DF5D50000-0x0000020DF7E58000-memory.dmp

Download

memory/704-393-0x0000020DFBD90000-0x0000020DFC5D1000-memory.dmp

Download

memory/704-401-0x0000020DFBD00000-0x0000020DFBD80000-memory.dmp

Download

memory/704-395-0x0000020DFBD90000-0x0000020DFC5D1000-memory.dmp

Download

memory/704-394-0x0000020DFBD90000-0x0000020DFC5D1000-memory.dmp

Download

memory/704-396-0x0000020DF97D0000-0x0000020DF97D1000-memory.dmp

Download

memory/756-339-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/788-336-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/3308-338-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/3700-0-0x00000000000B0000-0x000000000018C000-memory.dmp

Download

memory/3700-361-0x00000000000B0000-0x000000000018C000-memory.dmp

Download

memory/3700-20-0x00000000000B0000-0x000000000018C000-memory.dmp

Download

memory/4444-358-0x0000000000500000-0x00000000009E6000-memory.dmp

Download

memory/4444-360-0x0000000000500000-0x00000000009E6000-memory.dmp

Download

memory/4444-170-0x0000000000500000-0x00000000009E6000-memory.dmp

Download

memory/4444-22-0x00000000017D0000-0x00000000017D1000-memory.dmp

Download

memory/4444-21-0x0000000000500000-0x00000000009E6000-memory.dmp

Download

memory/4444-5-0x00000000017D0000-0x00000000017D1000-memory.dmp

Download