cc0655c88ad1143acff24093bd971a9a0ff000b3ec9e69f48832477f0800b408

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
4824	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1708	icsys.icn.exe
2392	explorer.exe
4472	spoolsv.exe
3524	svchost.exe
1824	spoolsv.exe

Loads dropped DLL 35 IoCs

pid	Process
1544	vcredist_x86.exe
5292	vcredist_x86.exe
5468	VC_redist.x86.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
6128	VC_redist.x86.exe
5520	MsiExec.exe
5520	MsiExec.exe
5520	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5720	MsiExec.exe
5996	MsiExec.exe
6132	MsiExec.exe
5252	MsiExec.exe
5484	MsiExec.exe

System Binary Proxy Execution: Rundll32 1 TTPs 6 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
868	rundll32.exe
4932	rundll32.exe
2400	rundll32.exe
5660	rundll32.exe
228	rundll32.exe
3308	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfc70fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msdatgrd.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp70.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dbadapt.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mschrt20.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr70.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\atl71.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomct2.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comct232.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomm32.ocx	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\richtx32.ocx	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msflxgrd.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\picclp32.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msadodc.ocx	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71deu.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
3972	cscript.exe
4960	cscript.exe
692	cscript.exe
3988	cscript.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\DESIGNER\mscdrun.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mshtmpgr.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mswcrun.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE33C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\vcred11_x86.inf	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A06.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232717.0\8.0.50727.6229.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\e5922a9.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\CacheSize.txt	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236858.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\Installer\e592288.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120fra_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.0\mfc90esn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.0\mfc90ita.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236873.0\mfcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236858.0\msvcr90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204236920.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120kor_x86	msiexec.exe
File created	C:\Windows\Installer\e5922d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A16.tmp	msiexec.exe
File created	C:\Windows\Installer\e592289.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120rus_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5603.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcp100_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232670.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\INF\SET7C94.tmp	rundll32.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI377A.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204232389.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86	msiexec.exe
File created	C:\Windows\Installer\e5922bb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5922ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3580.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120fra_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37AA.tmp	msiexec.exe
File created	C:\Windows\Installer\e592283.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204232483.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e592289.msi	msiexec.exe
File opened for modification	C:\Windows\INF\SET7C17.tmp	rundll32.exe
File created	C:\Windows\INF\SET7C17.tmp	rundll32.exe
File opened for modification	C:\Windows\INF\vcred14_x86.inf	rundll32.exe
File opened for modification	C:\Windows\Installer\e592296.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcomp120_x86	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204232561.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI338B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI59F5.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232483.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232483.0\mfc80u.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100deu_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232561.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfc120u_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232389.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.cat	msiexec.exe
File opened for modification	C:\Windows\INF\vcred09_x86.inf	rundll32.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204232733.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.0\mfc90deu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.0\mfc90rus.dll	msiexec.exe
File created	C:\Windows\Installer\e5922de.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_vcomp100_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.1\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_7e578468.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204236889.1\vcomp90.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3344	cmd.exe
2984	cmd.exe
3940	cmd.exe
996	cmd.exe
3204	cmd.exe
4484	cmd.exe
3780	cmd.exe
4268	cmd.exe
516	cmd.exe
4164	cmd.exe
2460	cmd.exe
980	cmd.exe
1704	cmd.exe
4500	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001302849f6a5860da0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001302849f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809001302849f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a1302849f000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1302849f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\AlternateCLSID = "{D7FFEFBC-C693-4E6F-AE2E-ED001389CB17}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00028C00-0000-0000-0000-000000000046}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\AlternateCLSID = "{261399BF-4DBC-4731-B79F-EF8871D7CB36}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{642AC766-AAB4-11D0-8494-00A0C90DC8A9}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{59245250-7A2F-11D0-9482-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A2B370C-BA0A-11D1-B137-0000F8753F5D}\AlternateCLSID = "{62B025F5-F551-44A9-8BA8-0118EFB9127C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{601EB760-8909-11D0-9483-00A0C91110ED}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{648A5600-2C6E-101B-82B6-000000000014}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{53749718-F78D-4A67-8703-8AE050075170}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}\AlternateCLSID = "{261399BF-4DBC-4731-B79F-EF8871D7CB36}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9012A7B8-F56E-11D0-8043-00C04FB6C701}\AlternateCLSID = "{CB2C5FC2-C7ED-4CC1-AF07-5C5485DAB3B1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{43478D73-78E0-11CF-8E78-00A0D100038E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{43478D73-78E0-11CF-8E78-00A0D100038E}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{24B224E0-9545-4a2f-ABD5-86AA8A849385}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}\AlternateCLSID = "{A289A6BA-6B23-4969-8981-9B2C28290D0F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\AlternateCLSID = "{D88A442E-9C85-48E3-A6F8-EF61C93989A0}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\AlternateCLSID = "{62B025F5-F551-44A9-8BA8-0118EFB9127C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FAEEE760-117E-101B-8933-08002B2F4F5A}\AlternateCLSID = "{30854451-8F2D-4282-8070-73A801B560A3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{53749718-F78D-4A67-8703-8AE050075170}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{612A8624-0FB3-11CE-8747-524153480004}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\AlternateCLSID = "{996BF5E0-8044-4650-ADEB-0B013914E99C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\AlternateCLSID = "{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\AlternateCLSID = "{DD2DBE12-F9F8-4E32-B087-DAD1DCEF0783}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CAB-15DA-101B-B9A8-444553540000}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9012A7B8-F56E-11D0-8043-00C04FB6C701}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BFCA30D5-DDE3-11D1-B6D9-0000F87557F8}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 34 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{38911DA0-E448-11D0-84A3-00DD01104159}\1.1\0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\PackageCode = "E554C16404AD3B9478B14103C87CECFF"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ComCtl2.UpDown.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D8C1B55B-12DC-457F-97EC-4B84305FAA13}\ToolboxBitmap32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E675F3F0-91B5-11D0-9484-00A0C91110ED}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{648A5603-2C6E-101B-82B6-000000000014}\1.1\FLAGS\ = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSComctlLib.SBarCtrl	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscomctl.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CDE57A54-8B86-11D0-B3C6-00A0C90AEA82}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E0751D-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{648A5600-2C6E-101B-82B6-000000000014}\ToolboxBitmap32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\ToolboxBitmap32\ = "C:\\Windows\\SysWOW64\\comctl32.ocx, 2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BEB05740-057C-11D1-B7E8-00A0D10037E4}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE387538-44A3-11D1-B5B7-0000C09000C4}\ = "IFlatSB"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21D93910-CB0F-11D0-84AC-00A0C90DC8A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\TypeLib\Version = "1.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Control	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5522DAF7-06D6-11D2-8D70-00A0C98B28E2}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{78E93845-85FD-11D0-8487-00A0C90DC8A9}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D646316D-0915-421A-84C1-6A21C2495791}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Control	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{232E4565-87C3-11D1-8BE3-0000F8754DA1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1F6F8D20-1B7D-11CF-9D53-00AA003C9CB6}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\81EC7FB4151EF9441909C6BDDEB04B2A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSDataRepeaterLib.DataRepeater\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\ = "Microsoft Toolbar Control 6.0 (SP6)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43478D73-78E0-11CF-8E78-00A0D100038E}\ProgID\ = "msrdc20.RemoteDataCtl.2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F6565773-FA54-45E9-941C-2505E54D5710}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC5D0DE0-BD4C-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20DD1B9B-87C4-11D1-8BE3-0000F8754DA1}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDataReportRuntimeLib.DataReport.1\CLSID\ = "{642AC766-AAB4-11D0-8494-00A0C90DC8A9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AC5D0DE4-BD4C-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSMAPI.MAPIMessages\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9A8831F1-A263-11D1-8DCF-00A0C90FFFC2}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3D-8596-11D1-B16A-00C0F0283628}\ = "Slider Appearance Property Page Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5E71F04C-551F-11CF-8152-00AA00A40C25}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{8F0F480A-4366-4737-8265-2AD6FDAC8C31}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.ImageListCtrl"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ = "Microsoft ListView Control 6.0 (SP6)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{74DD2713-BA98-4D10-A16E-270BBEB9B555}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}\Version\ = "1.5"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{4CAD92F0-D7C4-11D0-BCF7-00C04FC2FB86}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{234086BB-0242-46C5-B71F-5A9B961DB911}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80793196-F254-4F97-91CD-91569367633F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BDC217C7-ED16-11CD-956C-0000C04E4C0A}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1EAC2F2A-251F-4BA8-8617-99A8DD715453}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\Implemented Categories	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
4152	reg.exe
3328	reg.exe
4560	reg.exe
5128	reg.exe
4816	reg.exe
1344	reg.exe
5080	reg.exe
2884	reg.exe
5256	reg.exe
5428	reg.exe
4064	reg.exe
3568	reg.exe
4784	reg.exe
1428	reg.exe
5332	reg.exe
2480	reg.exe
3368	reg.exe
3376	reg.exe
3280	reg.exe
4364	reg.exe
880	reg.exe
4520	reg.exe
3884	reg.exe
2380	reg.exe
4856	reg.exe
2976	reg.exe
5076	reg.exe
3520	reg.exe
4604	reg.exe
5528	reg.exe
4772	reg.exe
2212	reg.exe
3152	reg.exe
4928	reg.exe
3192	reg.exe
2700	reg.exe
4764	reg.exe
4892	reg.exe
2288	reg.exe
696	reg.exe
4700	reg.exe
1048	reg.exe
4416	reg.exe
5580	reg.exe
3652	reg.exe
4372	reg.exe
4140	reg.exe
4852	reg.exe
2184	reg.exe
3260	reg.exe
4448	reg.exe
6064	reg.exe
4456	reg.exe
1480	reg.exe
4040	reg.exe
2972	reg.exe
2008	reg.exe
2064	reg.exe
5348	reg.exe
5316	reg.exe
4580	reg.exe
4708	reg.exe
3744	reg.exe
1160	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
1708	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2392	explorer.exe
3524	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe
Token: SeSecurityPrivilege	2240	WMIC.exe
Token: SeTakeOwnershipPrivilege	2240	WMIC.exe
Token: SeLoadDriverPrivilege	2240	WMIC.exe
Token: SeSystemProfilePrivilege	2240	WMIC.exe
Token: SeSystemtimePrivilege	2240	WMIC.exe
Token: SeProfSingleProcessPrivilege	2240	WMIC.exe
Token: SeIncBasePriorityPrivilege	2240	WMIC.exe
Token: SeCreatePagefilePrivilege	2240	WMIC.exe
Token: SeBackupPrivilege	2240	WMIC.exe
Token: SeRestorePrivilege	2240	WMIC.exe
Token: SeShutdownPrivilege	2240	WMIC.exe
Token: SeDebugPrivilege	2240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2240	WMIC.exe
Token: SeRemoteShutdownPrivilege	2240	WMIC.exe
Token: SeUndockPrivilege	2240	WMIC.exe
Token: SeManageVolumePrivilege	2240	WMIC.exe
Token: 33	2240	WMIC.exe
Token: 34	2240	WMIC.exe
Token: 35	2240	WMIC.exe
Token: 36	2240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe
Token: SeSecurityPrivilege	2240	WMIC.exe
Token: SeTakeOwnershipPrivilege	2240	WMIC.exe
Token: SeLoadDriverPrivilege	2240	WMIC.exe
Token: SeSystemProfilePrivilege	2240	WMIC.exe
Token: SeSystemtimePrivilege	2240	WMIC.exe
Token: SeProfSingleProcessPrivilege	2240	WMIC.exe
Token: SeIncBasePriorityPrivilege	2240	WMIC.exe
Token: SeCreatePagefilePrivilege	2240	WMIC.exe
Token: SeBackupPrivilege	2240	WMIC.exe
Token: SeRestorePrivilege	2240	WMIC.exe
Token: SeShutdownPrivilege	2240	WMIC.exe
Token: SeDebugPrivilege	2240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2240	WMIC.exe
Token: SeRemoteShutdownPrivilege	2240	WMIC.exe
Token: SeUndockPrivilege	2240	WMIC.exe
Token: SeManageVolumePrivilege	2240	WMIC.exe
Token: 33	2240	WMIC.exe
Token: 34	2240	WMIC.exe
Token: 35	2240	WMIC.exe
Token: 36	2240	WMIC.exe
Token: SeBackupPrivilege	736	vssvc.exe
Token: SeRestorePrivilege	736	vssvc.exe
Token: SeAuditPrivilege	736	vssvc.exe
Token: SeShutdownPrivilege	5732	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	5732	VC_redist.x86.exe
Token: SeSecurityPrivilege	5792	msiexec.exe
Token: SeCreateTokenPrivilege	5732	VC_redist.x86.exe
Token: SeAssignPrimaryTokenPrivilege	5732	VC_redist.x86.exe
Token: SeLockMemoryPrivilege	5732	VC_redist.x86.exe
Token: SeIncreaseQuotaPrivilege	5732	VC_redist.x86.exe
Token: SeMachineAccountPrivilege	5732	VC_redist.x86.exe
Token: SeTcbPrivilege	5732	VC_redist.x86.exe
Token: SeSecurityPrivilege	5732	VC_redist.x86.exe
Token: SeTakeOwnershipPrivilege	5732	VC_redist.x86.exe
Token: SeLoadDriverPrivilege	5732	VC_redist.x86.exe
Token: SeSystemProfilePrivilege	5732	VC_redist.x86.exe
Token: SeSystemtimePrivilege	5732	VC_redist.x86.exe
Token: SeProfSingleProcessPrivilege	5732	VC_redist.x86.exe
Token: SeIncBasePriorityPrivilege	5732	VC_redist.x86.exe
Token: SeCreatePagefilePrivilege	5732	VC_redist.x86.exe
Token: SeCreatePermanentPrivilege	5732	VC_redist.x86.exe
Token: SeBackupPrivilege	5732	VC_redist.x86.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4824	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1544	vcredist_x86.exe
5468	VC_redist.x86.exe
5284	msiexec.exe
6128	VC_redist.x86.exe
5284	msiexec.exe
5268	msiexec.exe
5268	msiexec.exe
5852	msiexec.exe
5852	msiexec.exe
4592	msiexec.exe
4592	msiexec.exe
3232	msiexec.exe
3232	msiexec.exe
2384	msiexec.exe
2384	msiexec.exe
5676	msiexec.exe
5676	msiexec.exe
2592	msiexec.exe
2592	msiexec.exe
6052	msiexec.exe
6052	msiexec.exe
3944	msiexec.exe
3944	msiexec.exe
2780	msiexec.exe
2780	msiexec.exe
5552	msiexec.exe
5552	msiexec.exe
5336	msiexec.exe
5336	msiexec.exe
4540	msiexec.exe
4540	msiexec.exe
2500	msiexec.exe
2500	msiexec.exe
4736	msiexec.exe
4736	msiexec.exe
6096	msiexec.exe
6096	msiexec.exe
6032	msiexec.exe
6032	msiexec.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1708	icsys.icn.exe
1708	icsys.icn.exe
2392	explorer.exe
2392	explorer.exe
4472	spoolsv.exe
4472	spoolsv.exe
3524	svchost.exe
3524	svchost.exe
1824	spoolsv.exe
1824	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4824	3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	89
PID 3508 wrote to memory of 1708	3508	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	91
PID 1708 wrote to memory of 2392	1708	icsys.icn.exe	92
PID 2392 wrote to memory of 4472	2392	explorer.exe	93
PID 4472 wrote to memory of 3524	4472	spoolsv.exe	94
PID 3524 wrote to memory of 1824	3524	svchost.exe	95
PID 4824 wrote to memory of 980	4824	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	105
PID 980 wrote to memory of 1704	980	cmd.exe	107
PID 1704 wrote to memory of 3788	1704	cmd.exe	108
PID 980 wrote to memory of 1632	980	cmd.exe	109
PID 980 wrote to memory of 680	980	cmd.exe	110
PID 980 wrote to memory of 4500	980	cmd.exe	111
PID 980 wrote to memory of 4708	980	cmd.exe	112
PID 980 wrote to memory of 2240	980	cmd.exe	113
PID 980 wrote to memory of 3400	980	cmd.exe	114
PID 980 wrote to memory of 3344	980	cmd.exe	115
PID 3344 wrote to memory of 2064	3344	cmd.exe	116
PID 980 wrote to memory of 2984	980	cmd.exe	117
PID 2984 wrote to memory of 4808	2984	cmd.exe	118
PID 980 wrote to memory of 4484	980	cmd.exe	119
PID 4484 wrote to memory of 3044	4484	cmd.exe	120
PID 980 wrote to memory of 4528	980	cmd.exe	121
PID 980 wrote to memory of 3016	980	cmd.exe	122
PID 980 wrote to memory of 3104	980	cmd.exe	123
PID 980 wrote to memory of 4100	980	cmd.exe	124
PID 980 wrote to memory of 3940	980	cmd.exe	125
PID 3940 wrote to memory of 3972	3940	cmd.exe	126
PID 980 wrote to memory of 996	980	cmd.exe	127
PID 980 wrote to memory of 3780	980	cmd.exe	128
PID 3780 wrote to memory of 4960	3780	cmd.exe	129
PID 980 wrote to memory of 3204	980	cmd.exe	130
PID 980 wrote to memory of 4268	980	cmd.exe	131
PID 4268 wrote to memory of 692	4268	cmd.exe	132
PID 980 wrote to memory of 516	980	cmd.exe	133
PID 980 wrote to memory of 4164	980	cmd.exe	134
PID 4164 wrote to memory of 3988	4164	cmd.exe	135
PID 980 wrote to memory of 2460	980	cmd.exe	136
PID 980 wrote to memory of 740	980	cmd.exe	137
PID 980 wrote to memory of 3168	980	cmd.exe	138
PID 980 wrote to memory of 3856	980	cmd.exe	139
PID 980 wrote to memory of 4816	980	cmd.exe	140
PID 980 wrote to memory of 4796	980	cmd.exe	141
PID 980 wrote to memory of 4720	980	cmd.exe	142
PID 980 wrote to memory of 2324	980	cmd.exe	143
PID 980 wrote to memory of 2424	980	cmd.exe	144
PID 980 wrote to memory of 3828	980	cmd.exe	145
PID 980 wrote to memory of 3152	980	cmd.exe	146
PID 980 wrote to memory of 1480	980	cmd.exe	147
PID 980 wrote to memory of 2504	980	cmd.exe	148
PID 980 wrote to memory of 3652	980	cmd.exe	149
PID 980 wrote to memory of 3964	980	cmd.exe	150
PID 980 wrote to memory of 1960	980	cmd.exe	151
PID 980 wrote to memory of 1344	980	cmd.exe	152
PID 980 wrote to memory of 2976	980	cmd.exe	153
PID 980 wrote to memory of 4152	980	cmd.exe	154
PID 980 wrote to memory of 5076	980	cmd.exe	155
PID 980 wrote to memory of 1160	980	cmd.exe	156
PID 980 wrote to memory of 4676	980	cmd.exe	157
PID 980 wrote to memory of 392	980	cmd.exe	158
PID 980 wrote to memory of 2080	980	cmd.exe	159
PID 980 wrote to memory of 5072	980	cmd.exe	160
PID 980 wrote to memory of 3460	980	cmd.exe	161
PID 980 wrote to memory of 3612	980	cmd.exe	162
PID 980 wrote to memory of 2604	980	cmd.exe	163

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508
- \??\c:\users\admin\appdata\local\temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
    3⤵
    - Checks computer location settings
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\Windows\system32\reg.exe
        
        reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:3788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1632
  - - C:\Windows\system32\findstr.exe
      findstr /c:" 5."
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4500
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:4708
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:2240
  - - C:\Windows\system32\find.exe
      find /i "ComputerSystem"
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3344
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
        5⤵
        
        PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2984
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
        5⤵
        
        PID:4808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        5⤵
        
        PID:3044
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:4528
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:3016
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:3104
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40664.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:516
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 51.36247.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:740
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:3168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3856
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:4816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:4720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:2424
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
      4⤵
      PID:3828
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:3152
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
      4⤵
      Modifies registry key
      PID:1480
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:2504
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      Modifies registry key
      PID:3652
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      PID:3964
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:1960
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:1344
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:2976
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
      4⤵
      Modifies registry key
      PID:4152
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
      4⤵
      Modifies registry key
      PID:5076
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4BF7CE18-E151-449F-9190-6CDBED0BB4A2} /v UninstallString
      4⤵
      Modifies registry key
      PID:1160
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{582BA719-E6F1-4651-A873-049E6A0DDDAF} /v UninstallString
      4⤵
      PID:4676
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
      4⤵
      PID:392
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2080
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5072
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
      4⤵
      PID:3460
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3612
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2604
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
      4⤵
      PID:2992
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4896
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4604
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4040
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5116
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4588
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4064
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2860
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3604
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      PID:3824
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2832
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2516
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2972
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3028
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1616
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:5080
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4884
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4080
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
      4⤵
      PID:2032
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1300
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4428
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      PID:4320
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3132
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4128
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3568
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3944
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4700
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      PID:1700
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4224
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5028
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4856
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3600
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5064
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      PID:4240
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3404
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2308
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3744
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4828
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2408
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2212
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1164
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3360
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4816
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2672
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:788
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Runtime" /s
      4⤵
      Modifies registry key
      PID:4372
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4868
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1796
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
      4⤵
      Modifies registry key
      PID:3520
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2376
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2776
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
      4⤵
      PID:3676
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4488
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2640
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:2008
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5092
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4000
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4764
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:392
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3640
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
      4⤵
      Modifies registry key
      PID:4140
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4952
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:824
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:4604
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2196
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4624
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
      4⤵
      Modifies registry key
      PID:4892
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1492
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1568
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:4852
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4564
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1920
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
      4⤵
      Modifies registry key
      PID:3328
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1592
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1632
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
      4⤵
      PID:3808
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2680
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:780
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2064
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5024
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3144
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2288
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4020
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1240
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2884
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4380
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4528
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable" /s
      4⤵
      PID:4940
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3476
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2744
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2480
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2484
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3932
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:880
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:968
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1212
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4520
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2848
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1060
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2184
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4848
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2512
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4456
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3964
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4436
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
      4⤵
      PID:212
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:3260
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1676
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:744
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3884
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2344
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1324
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4580
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4724
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:696
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4604
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2400
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x64" /s
      4⤵
      PID:2764
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1820
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4900
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x86" /s
      4⤵
      PID:4836
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1668
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2340
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4708
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4264
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1352
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x86" /s
      4⤵
      PID:2564
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4804
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5024
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4784
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3568
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4860
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:1428
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3236
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2380
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:3368
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3404
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2384
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x86" /s
      4⤵
      PID:1760
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3680
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4496
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4560
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3928
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1976
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:4448
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4292
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4848
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x64" /s
      4⤵
      PID:736
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1904
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2940
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x86" /s
      4⤵
      PID:2732
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2008
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4000
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4928
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4660
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4640
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3192
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3056
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4476
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:3376
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:696
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2400
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable *x86" /s
      4⤵
      PID:4252
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4420
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1592
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable *x64" /s
      4⤵
      PID:4836
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2340
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:468
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3280
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2712
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4300
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4700
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3004
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4100
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:1048
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3236
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1428
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
    - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{CB0B9786-973E-458D-A2AD-3C2C961AD9DF} {F3F5279F-ED3D-4DDE-8176-447E15F8E4C7} 2308
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1544
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
      4⤵
      Modifies registry key
      PID:5256
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{2B027A79-89B1-4D48-A87B-C8EF88B38DD7} {8DA96EA3-2D02-48B1-896E-FF224B6FF5EA} 5272
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5292
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
      4⤵
      PID:5432
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=532 -burn.filehandle.self=552 /uninstall /passive /norestart
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5468
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5CEFB7ED-A4C7-4E17-B3BB-1648889F0DE9} {B7439D5F-47EF-4F4E-B9D3-7E0E8FD7B63B} 5468
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5732
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
      4⤵
      PID:5408
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:5296
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:5348
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:5284
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
      4⤵
      PID:1824
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      PID:4364
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:5268
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
      4⤵
      Modifies registry key
      PID:5316
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      PID:5332
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      PID:5852
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
      4⤵
      Modifies registry key
      PID:2380
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:4416
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      PID:4592
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
      4⤵
      Modifies registry key
      PID:5128
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
      4⤵
      Modifies registry key
      PID:6064
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{7DAD0258-515C-3DD4-8964-BD714199E0F7} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      PID:3232
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /f
      4⤵
      PID:6056
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
      4⤵
      PID:3816
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      PID:2384
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /f
      4⤵
      Modifies registry key
      PID:5528
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
      4⤵
      PID:1824
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
      4⤵
      Modifies registry key
      PID:4364
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" MSIFASTINSTALL=3 /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5676
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" MSIFASTINSTALL=3 /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2592
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" MSIFASTINSTALL=3 /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:6052
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3944
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2780
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5552
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5336
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4540
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2500
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      PID:2188
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      Modifies registry key
      PID:4772
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      PID:4344
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:4736
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      PID:6096
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" MSIFASTINSTALL=3 /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:6032
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a
      4⤵
      Modifies registry key
      PID:5580
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2005\x86\vcred08_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:228
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
      4⤵
      PID:4216
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2008\x86\vcred09_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      Drops file in Windows directory
      PID:3308
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      Modifies registry key
      PID:5428
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2010\x86\vcred10_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:868
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\DC8A59DBF9D1DA5389A1E3975220E6BB
      4⤵
      Modifies registry key
      PID:2700
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2012\x86\vcred11_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      Drops file in Windows directory
      PID:4932
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1BAD2218D4DE6763BBA0AC63186945E3
      4⤵
      PID:1556
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2013\x86\vcred12_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      Drops file in Windows directory
      PID:2400
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\81EC7FB4151EF9441909C6BDDEB04B2A
      4⤵
      Modifies registry key
      PID:5332
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2026\x86\vcred14_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      Drops file in Windows directory
      PID:5660
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1708
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4472
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1824

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:2184
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv WcfZ4kz/M0iMQf+cPqicAw.0.2
1⤵
PID:3328

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5792
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 3FC953D62CC150B368E310E0C546B561
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5520
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 91220516AC28103E91D275837E9D33DE
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EC4C051C2D4AD5A6316373E4F8AE4D63
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5CDB57F19C5AE839602E0FCC8DEE4745
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 45BF5C421EABCC3DA79E61FC396B5274
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0CB4D58AFEDAEC55991B975F22296DA0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5252
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8D70C2631D3C8BD1DB1BB56CD5BDEF8C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5484

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:6084
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260930204156.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6104
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260930204156.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery