cc0655c88ad1143acff24093bd971a9a0ff000b3ec9e69f48832477f0800b408

Analysis

max time kernel
109s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Size 19.4MB
Sample260930-yd3yrsshna
SHA256 cc0655c88ad1143acff24093bd971a9a0ff000b3ec9e69f48832477f0800b408
MD5 6d6ca4dcb7d7eb8a37292bad86c154c9
SHA1 65493b41806ea12778e483ad5139ddc28036310e
SHA512 327733a96424287f22ec8a0beb1d24a2db3b6f76967067f49f1f35bbc9b3b684826346f997f00a56ed737eb421561f8dcc990dcb9ab68519840e77c481f088df
SSDEEP 393216:f1A0F64RpEuaQSiHYjORB6MzWy08TQTy5ccxSu4:9h//3RBDWyGy5Bxp4
TLSH
T1872733B11A09407DEBE0B1F54A4AF49676ECFD78E5D58C8A30F07E4DA0AE4205EF212D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
4628	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3444	icsys.icn.exe
6072	explorer.exe
3100	spoolsv.exe
504	svchost.exe
2532	spoolsv.exe

Loads dropped DLL 36 IoCs

pid	Process
4100	vcredist_x86.exe
1548	vcredist_x86.exe
4320	VC_redist.x86.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2792	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
2428	MsiExec.exe
472	MsiExec.exe
4088	MsiExec.exe
4480	MsiExec.exe
6124	MsiExec.exe
4520	MsiExec.exe
2416	MsiExec.exe
4140	MsiExec.exe

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
5624	rundll32.exe
5692	rundll32.exe
1008	rundll32.exe
3336	rundll32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\atl100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
1536	cscript.exe
4260	cscript.exe
5088	cscript.exe
1784	cscript.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDCE190A18991D8BA.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100kor_x86	msiexec.exe
File created	C:\Windows\Installer\e5a5bc6.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240321.0\8.0.50727.6229.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204240058.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249440.0\mfc90deu.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6214.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67DB.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240272.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_45a306ec.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249440.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_a38742d1.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249426.0\msvcp90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204249412.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE9C2B61A4727D18.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5bdd.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240058.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240098.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240147.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240321.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240333.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240333.0\8.0.50727.6229.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204240147.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI732B.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204240333.0	msiexec.exe
File created	C:\Windows\Installer\e5a5bcb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5bcb.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249469.0\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249435.0\mfc90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249440.0\mfc90chs.dll	msiexec.exe
File created	C:\Windows\Installer\e5a5bcf.msi	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100cht_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240098.0\msvcr80.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5ACDC16C3D6A15D9.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249440.0\mfc90esp.dll	msiexec.exe
File created	C:\Windows\Installer\e5a5bd0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcp120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B42.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_vcomp100_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240272.0\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_45a306ec.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240296.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249445.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_7e578468.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249461.0\9.0.30729.7523.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204249426.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204249445.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240202.0\mfc80JPN.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204240286.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204249454.0\9.0.30729.7523.policy	msiexec.exe
File created	C:\Windows\Installer\e5a5bd6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5bdd.msi	msiexec.exe
File created	C:\Windows\Installer\e5a5be6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F04.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI663F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI677B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260930204240098.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260930204240307.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF386A433F05D7592B.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D3C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
964	cmd.exe
3428	cmd.exe
576	cmd.exe
5584	cmd.exe
1940	cmd.exe
6116	cmd.exe
2244	cmd.exe
2832	cmd.exe
628	cmd.exe
1688	cmd.exe
1656	cmd.exe
4892	cmd.exe
5224	cmd.exe
2408	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000094b15be3c89983180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380194b15be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410194b15be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e394b15be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e694b15be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Version = "151025673"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2010\\x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e007700700054005f0057007300410021004100360025004c0074006400690047004d00520033006f0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e002d0044003600350033005b0021004b0072003400470033004000310070002600550043005300780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e002b0073004f0051006d006300660034006f00370054002c007800450031004d00470062006100270000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\Version = "201367256"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\PackageName = "vcredist.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F603C2ED760AFE838BC630EDB430219F\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2012\\x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2008\\x86\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Language = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1BAD2218D4DE6763BBA0AC63186945E3\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\PackageCode = "82C7CC9682E1077408579187FC5DC13E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e00710041004b0072006e0029006f0079003700340050006000210030006d005100380045002500540000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2723430 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2005\\x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e006100330058006700470048006e0025004200360076003100360073005700750038006b004d00640000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2151757 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\1 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2008\\x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006900450024005b004d00310025002e0064002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\FT_VCRedist_x86_KB2890375_Detection	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Media\1 = ";1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFCLOC,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e006600720038005f006c0028006d0032004e004400650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
400	reg.exe
472	reg.exe
1656	reg.exe
2856	reg.exe
5928	reg.exe
5656	reg.exe
2196	reg.exe
4764	reg.exe
1820	reg.exe
5184	reg.exe
5456	reg.exe
4108	reg.exe
764	reg.exe
5324	reg.exe
2812	reg.exe
3192	reg.exe
4772	reg.exe
5144	reg.exe
6004	reg.exe
2936	reg.exe
3116	reg.exe
2928	reg.exe
3820	reg.exe
2000	reg.exe
2828	reg.exe
5140	reg.exe
4576	reg.exe
2400	reg.exe
3880	reg.exe
4536	reg.exe
1336	reg.exe
4948	reg.exe
3128	reg.exe
5960	reg.exe
2684	reg.exe
2836	reg.exe
4624	reg.exe
3368	reg.exe
5928	reg.exe
4224	reg.exe
4092	reg.exe
3420	reg.exe
2512	reg.exe
4500	reg.exe
5384	reg.exe
5696	reg.exe
5388	reg.exe
1848	reg.exe
2864	reg.exe
2500	reg.exe
5140	reg.exe
4544	reg.exe
2696	reg.exe
5300	reg.exe
4904	reg.exe
2516	reg.exe
4888	reg.exe
5828	reg.exe
2444	reg.exe
5504	reg.exe
1772	reg.exe
4764	reg.exe
3332	reg.exe
3432	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
3444	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
6072	explorer.exe
504	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5844	WMIC.exe
Token: SeSecurityPrivilege	5844	WMIC.exe
Token: SeTakeOwnershipPrivilege	5844	WMIC.exe
Token: SeLoadDriverPrivilege	5844	WMIC.exe
Token: SeSystemProfilePrivilege	5844	WMIC.exe
Token: SeSystemtimePrivilege	5844	WMIC.exe
Token: SeProfSingleProcessPrivilege	5844	WMIC.exe
Token: SeIncBasePriorityPrivilege	5844	WMIC.exe
Token: SeCreatePagefilePrivilege	5844	WMIC.exe
Token: SeBackupPrivilege	5844	WMIC.exe
Token: SeRestorePrivilege	5844	WMIC.exe
Token: SeShutdownPrivilege	5844	WMIC.exe
Token: SeDebugPrivilege	5844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5844	WMIC.exe
Token: SeRemoteShutdownPrivilege	5844	WMIC.exe
Token: SeUndockPrivilege	5844	WMIC.exe
Token: SeManageVolumePrivilege	5844	WMIC.exe
Token: 33	5844	WMIC.exe
Token: 34	5844	WMIC.exe
Token: 35	5844	WMIC.exe
Token: 36	5844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5844	WMIC.exe
Token: SeSecurityPrivilege	5844	WMIC.exe
Token: SeTakeOwnershipPrivilege	5844	WMIC.exe
Token: SeLoadDriverPrivilege	5844	WMIC.exe
Token: SeSystemProfilePrivilege	5844	WMIC.exe
Token: SeSystemtimePrivilege	5844	WMIC.exe
Token: SeProfSingleProcessPrivilege	5844	WMIC.exe
Token: SeIncBasePriorityPrivilege	5844	WMIC.exe
Token: SeCreatePagefilePrivilege	5844	WMIC.exe
Token: SeBackupPrivilege	5844	WMIC.exe
Token: SeRestorePrivilege	5844	WMIC.exe
Token: SeShutdownPrivilege	5844	WMIC.exe
Token: SeDebugPrivilege	5844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5844	WMIC.exe
Token: SeRemoteShutdownPrivilege	5844	WMIC.exe
Token: SeUndockPrivilege	5844	WMIC.exe
Token: SeManageVolumePrivilege	5844	WMIC.exe
Token: 33	5844	WMIC.exe
Token: 34	5844	WMIC.exe
Token: 35	5844	WMIC.exe
Token: 36	5844	WMIC.exe
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeBackupPrivilege	5640	srtasks.exe
Token: SeRestorePrivilege	5640	srtasks.exe
Token: SeSecurityPrivilege	5640	srtasks.exe
Token: SeTakeOwnershipPrivilege	5640	srtasks.exe
Token: SeShutdownPrivilege	2396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2396	msiexec.exe
Token: SeSecurityPrivilege	1680	msiexec.exe
Token: SeCreateTokenPrivilege	2396	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2396	msiexec.exe
Token: SeLockMemoryPrivilege	2396	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2396	msiexec.exe
Token: SeMachineAccountPrivilege	2396	msiexec.exe
Token: SeTcbPrivilege	2396	msiexec.exe
Token: SeSecurityPrivilege	2396	msiexec.exe
Token: SeTakeOwnershipPrivilege	2396	msiexec.exe
Token: SeLoadDriverPrivilege	2396	msiexec.exe
Token: SeSystemProfilePrivilege	2396	msiexec.exe
Token: SeSystemtimePrivilege	2396	msiexec.exe
Token: SeProfSingleProcessPrivilege	2396	msiexec.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4628	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
4100	vcredist_x86.exe
1548	vcredist_x86.exe
2396	msiexec.exe
2396	msiexec.exe
2044	msiexec.exe
2044	msiexec.exe
1572	msiexec.exe
1572	msiexec.exe
3148	msiexec.exe
3148	msiexec.exe
4116	msiexec.exe
4116	msiexec.exe
3168	msiexec.exe
3168	msiexec.exe
3344	msiexec.exe
3344	msiexec.exe
4168	msiexec.exe
4168	msiexec.exe
4780	msiexec.exe
4780	msiexec.exe
2580	msiexec.exe
2580	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
5344	msiexec.exe
5344	msiexec.exe
1428	msiexec.exe
1428	msiexec.exe
5444	msiexec.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
3444	icsys.icn.exe
3444	icsys.icn.exe
6072	explorer.exe
6072	explorer.exe
3100	spoolsv.exe
3100	spoolsv.exe
504	svchost.exe
504	svchost.exe
2532	spoolsv.exe
2532	spoolsv.exe
2396	msiexec.exe
1680	msiexec.exe
2792	MsiExec.exe
2044	msiexec.exe
2428	MsiExec.exe
1572	msiexec.exe
472	MsiExec.exe
3148	msiexec.exe
4088	MsiExec.exe
4116	msiexec.exe
4480	MsiExec.exe
3168	msiexec.exe
6124	MsiExec.exe
3344	msiexec.exe
4520	MsiExec.exe
4168	msiexec.exe
2416	MsiExec.exe
4780	msiexec.exe
4140	MsiExec.exe
2580	msiexec.exe
5716	msiexec.exe
5344	msiexec.exe
1428	msiexec.exe
5444	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 4628	1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	89
PID 1720 wrote to memory of 3444	1720	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	90
PID 3444 wrote to memory of 6072	3444	icsys.icn.exe	91
PID 6072 wrote to memory of 3100	6072	explorer.exe	92
PID 3100 wrote to memory of 504	3100	spoolsv.exe	93
PID 504 wrote to memory of 2532	504	svchost.exe	94
PID 4628 wrote to memory of 6116	4628	2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe	97
PID 6116 wrote to memory of 5224	6116	cmd.exe	99
PID 5224 wrote to memory of 3976	5224	cmd.exe	100
PID 6116 wrote to memory of 1332	6116	cmd.exe	101
PID 6116 wrote to memory of 2400	6116	cmd.exe	102
PID 6116 wrote to memory of 2408	6116	cmd.exe	103
PID 6116 wrote to memory of 6104	6116	cmd.exe	104
PID 6116 wrote to memory of 5844	6116	cmd.exe	105
PID 6116 wrote to memory of 3160	6116	cmd.exe	106
PID 6116 wrote to memory of 2244	6116	cmd.exe	108
PID 2244 wrote to memory of 1696	2244	cmd.exe	109
PID 6116 wrote to memory of 2832	6116	cmd.exe	110
PID 2832 wrote to memory of 5928	2832	cmd.exe	111
PID 6116 wrote to memory of 628	6116	cmd.exe	112
PID 628 wrote to memory of 1648	628	cmd.exe	113
PID 6116 wrote to memory of 976	6116	cmd.exe	114
PID 6116 wrote to memory of 5668	6116	cmd.exe	115
PID 6116 wrote to memory of 2892	6116	cmd.exe	116
PID 6116 wrote to memory of 4200	6116	cmd.exe	117
PID 6116 wrote to memory of 1688	6116	cmd.exe	118
PID 1688 wrote to memory of 1784	1688	cmd.exe	119
PID 6116 wrote to memory of 1656	6116	cmd.exe	238
PID 6116 wrote to memory of 964	6116	cmd.exe	121
PID 964 wrote to memory of 1536	964	cmd.exe	122
PID 6116 wrote to memory of 3428	6116	cmd.exe	123
PID 6116 wrote to memory of 4892	6116	cmd.exe	124
PID 4892 wrote to memory of 4260	4892	cmd.exe	125
PID 6116 wrote to memory of 576	6116	cmd.exe	126
PID 6116 wrote to memory of 5584	6116	cmd.exe	127
PID 5584 wrote to memory of 5088	5584	cmd.exe	128
PID 6116 wrote to memory of 1940	6116	cmd.exe	129
PID 6116 wrote to memory of 1404	6116	cmd.exe	130
PID 6116 wrote to memory of 2472	6116	cmd.exe	131
PID 6116 wrote to memory of 3608	6116	cmd.exe	132
PID 6116 wrote to memory of 4696	6116	cmd.exe	247
PID 6116 wrote to memory of 3360	6116	cmd.exe	134
PID 6116 wrote to memory of 204	6116	cmd.exe	135
PID 6116 wrote to memory of 4388	6116	cmd.exe	339
PID 6116 wrote to memory of 1644	6116	cmd.exe	137
PID 6116 wrote to memory of 3880	6116	cmd.exe	138
PID 6116 wrote to memory of 5504	6116	cmd.exe	139
PID 6116 wrote to memory of 4772	6116	cmd.exe	140
PID 6116 wrote to memory of 4616	6116	cmd.exe	141
PID 6116 wrote to memory of 2864	6116	cmd.exe	142
PID 6116 wrote to memory of 2500	6116	cmd.exe	143
PID 6116 wrote to memory of 2288	6116	cmd.exe	144
PID 6116 wrote to memory of 3128	6116	cmd.exe	145
PID 6116 wrote to memory of 5140	6116	cmd.exe	259
PID 6116 wrote to memory of 2928	6116	cmd.exe	147
PID 6116 wrote to memory of 1772	6116	cmd.exe	148
PID 6116 wrote to memory of 3972	6116	cmd.exe	149
PID 6116 wrote to memory of 1304	6116	cmd.exe	262
PID 6116 wrote to memory of 5700	6116	cmd.exe	151
PID 6116 wrote to memory of 3396	6116	cmd.exe	152
PID 6116 wrote to memory of 5952	6116	cmd.exe	153
PID 6116 wrote to memory of 2784	6116	cmd.exe	154
PID 6116 wrote to memory of 5864	6116	cmd.exe	267
PID 6116 wrote to memory of 5664	6116	cmd.exe	156

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- \??\c:\users\admin\appdata\local\temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
  c:\users\admin\appdata\local\temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\Windows\system32\reg.exe
        
        reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:3976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
  - - C:\Windows\system32\findstr.exe
      findstr /c:" 5."
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2408
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:6104
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:5844
  - - C:\Windows\system32\find.exe
      find /i "ComputerSystem"
      4⤵
      PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
        5⤵
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
        5⤵
        
        PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:628
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        5⤵
        
        PID:1648
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:976
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:5668
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:2892
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:4200
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1536
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40664.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5584
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 51.36247.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:204
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4388
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:1644
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
      4⤵
      Modifies registry key
      PID:3880
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:5504
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
      4⤵
      Modifies registry key
      PID:4772
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:4616
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      Modifies registry key
      PID:2864
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      Modifies registry key
      PID:2500
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:2288
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:3128
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:5140
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
      4⤵
      Modifies registry key
      PID:2928
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
      4⤵
      Modifies registry key
      PID:1772
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4BF7CE18-E151-449F-9190-6CDBED0BB4A2} /v UninstallString
      4⤵
      PID:3972
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{582BA719-E6F1-4651-A873-049E6A0DDDAF} /v UninstallString
      4⤵
      PID:1304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
      4⤵
      PID:5700
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3396
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5952
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
      4⤵
      PID:2784
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5864
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5664
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
      4⤵
      PID:2796
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5480
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5328
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4108
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1828
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5472
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4536
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3024
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1056
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      PID:1060
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1312
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4640
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      PID:4336
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2028
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4784
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
      4⤵
      PID:5920
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5312
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5320
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:400
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4264
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:364
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2512
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6044
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2900
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3820
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4812
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2044
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      PID:972
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4660
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3164
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4764
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:856
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2940
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      PID:4524
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5184
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4596
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4500
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5848
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5400
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      PID:4672
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5216
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3112
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2000
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1852
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2128
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Runtime" /s
      4⤵
      Modifies registry key
      PID:764
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5904
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:876
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5384
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4732
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2476
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
      4⤵
      PID:4180
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2856
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4240
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:4904
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1792
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2984
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5144
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4976
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1320
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
      4⤵
      PID:4176
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4688
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5908
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:5656
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5744
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5068
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
      4⤵
      PID:1400
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1492
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1164
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:5324
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5392
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2964
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2828
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3440
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2672
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
      4⤵
      PID:2376
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:952
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2648
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
      4⤵
      Modifies registry key
      PID:472
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:976
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3556
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1656
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4136
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3312
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2516
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:436
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2404
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable" /s
      4⤵
      PID:1612
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1044
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5364
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
      4⤵
      PID:4696
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5492
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1324
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:6004
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2456
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4128
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
      4⤵
      PID:3592
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5984
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5104
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4544
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3136
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2172
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5140
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5352
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1220
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
      4⤵
      PID:1304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:3116
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5172
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4836
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x86" /s
      4⤵
      PID:2624
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5864
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2504
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:2696
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5060
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3236
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:4888
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4652
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3812
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x64" /s
      4⤵
      PID:960
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4152
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1412
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3420
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1424
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5448
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:4092
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5988
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4304
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:5960
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3852
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:6136
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x64" /s
      4⤵
      PID:1548
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5784
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4436
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3332
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3740
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1604
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x64" /s
      4⤵
      PID:2532
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2332
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5500
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:3432
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4820
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:6008
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable *x64" /s
      4⤵
      PID:4948
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1992
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:712
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2026 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:2684
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:800
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5788
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x64" /s
      4⤵
      PID:1156
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2568
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5684
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:4576
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5940
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4432
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:1336
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1676
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3968
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:2856
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4180
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4240
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable *x64" /s
      4⤵
      PID:5992
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5396
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4272
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:2812
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3008
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4216
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:5828
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5344
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2026 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:2400
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1600
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2908
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x64" /s
      4⤵
      Modifies registry key
      PID:2836
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1696
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5824
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x86" /s
      4⤵
      Modifies registry key
      PID:5928
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5476
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3228
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
    - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{24159BED-AE47-4A93-815C-35A1DF335A0E} {347DFC68-4A63-499C-B9CD-111940C3FEF6} 5668
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4100
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
      4⤵
      PID:3016
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:5880
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{D930C3DE-84AE-46DB-9023-A530A3BADA0E} {7C29F402-858D-438E-9C0B-9D463C7ACE73} 5880
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1548
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
      4⤵
      Modifies registry key
      PID:2196
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=704 /uninstall /passive /norestart
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4320
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
      4⤵
      Modifies registry key
      PID:5696
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:2256
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      PID:5892
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2396
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
      4⤵
      Modifies registry key
      PID:4764
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      Modifies registry key
      PID:4948
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2044
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
      4⤵
      Modifies registry key
      PID:4624
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      PID:4708
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1572
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
      4⤵
      Modifies registry key
      PID:1820
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:5184
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3148
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
      4⤵
      Modifies registry key
      PID:3368
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
      4⤵
      Modifies registry key
      PID:5456
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{7DAD0258-515C-3DD4-8964-BD714199E0F7} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4116
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /f
      4⤵
      Modifies registry key
      PID:5388
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
      4⤵
      PID:1960
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3168
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /f
      4⤵
      PID:5716
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
      4⤵
      Modifies registry key
      PID:1848
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{BF08E976-B92E-4336-B56F-2171179476C4} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3344
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /f
      4⤵
      PID:4372
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
      4⤵
      PID:1964
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4168
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /f
      4⤵
      Modifies registry key
      PID:5928
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4780
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2580
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" MSIFASTINSTALL=3 /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5716
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5344
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1428
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5444
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb
      4⤵
      PID:4376
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      Modifies registry key
      PID:3192
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      Modifies registry key
      PID:2936
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      PID:5720
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
      4⤵
      PID:5820
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" MSIFASTINSTALL=3 /qb
      4⤵
      PID:4896
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      Modifies registry key
      PID:4224
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2010\x86\vcred10_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:1008
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\DC8A59DBF9D1DA5389A1E3975220E6BB
      4⤵
      Modifies registry key
      PID:5300
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2012\x86\vcred11_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:3336
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1BAD2218D4DE6763BBA0AC63186945E3
      4⤵
      Modifies registry key
      PID:2444
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2013\x86\vcred12_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:5624
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\81EC7FB4151EF9441909C6BDDEB04B2A
      4⤵
      PID:4712
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe advpack.dll,LaunchINFSectionEx .\2026\x86\vcred14_x86.inf,Install,,12,N
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:5692
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3444
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3100
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:504
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2532

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:2516
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
  2⤵
  PID:2032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:4388

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1680
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 203C4EE1D67D1F2A9A173C20E3855783
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2792
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 54431D961060B6A5274893A9FABA8F95
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2428
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 712A6B62C99A58ADC8D02D45E82F93C7
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0A686EBC1E613136C1ACF134D2BD0C04
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB3E6A34225F34F16D04DAD4699C8B5F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 52EED6A50DB9E9351851DFD2220B7AF3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9AD6DB57A96585B6B3164759C605F16D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4520
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC1B23484985DAAD4506FA92E43827C2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3210CFAA3FD54C690186DA5E7D7DBC40
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a5b91.rbs

Path C:\Config.Msi\e5a5b91.rbs
Size 31KB
SHA256 a1131f8de99bc64f27f2746df81cc442258092919d22bf5abe2a74c7b7fcb981
MD5 3044ec7fd826aa0e2f6a5bb3498237ef
SHA1 fbf865dde5e62eabd52f8ec95c4d755432c09eb3
SHA512 8a0ff323b9261ea101867300d2d21a4ee70ed28b9598294a88418918c77729549d9da6ac099267ac6428f8100fb2fa3c0bfce3689db8791a61b0daf6eb2a8c92
SSDEEP 384:7W8N8DRNeRpTu8iu8su8XcAlRTMV/ZawBV3yFgmklRu+Ru2S:7EspsKVvRIVxDe6lRu+RuJ
TLSH
T10CE25502F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5b95.rbs

Path C:\Config.Msi\e5a5b95.rbs
Size 49KB
SHA256 67186303fe65b23dcea4976e5e1bcdf9a23c299ad21fa2080a7d18e8c65c1b1f
MD5 5db45647c701a46407d24c87dd586d51
SHA1 3d5f5fae0e894a4f40670ebf3c998d9b0f30b6fe
SHA512 382310aa3fab0afbec05f29152a6e21e53c1e50eb7c91fe3e7454806c614f46c030d83d02dfa11ed5e1790b5cbc0b8e35c763ee0ffd0a6ae501a77156f00a9d4
SSDEEP 768:qgEJWVQKRy2Rs2iOD0MMGrLxBgh/f8+I/W8yl7j76HdpXk:3J7ij
TLSH
T1F033EE423344E6D3D6652A30CD430BB57F3BC3A69312866B54ADC1788FA3BC66E85E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bb9.rbf

Path C:\Config.Msi\e5a5bb9.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5a5bd3.rbs

Path C:\Config.Msi\e5a5bd3.rbs
Size 41KB
SHA256 4c6e5bac832043d14383d32af7821548c9a1460e66f61b86e0c1996ff06d3a83
MD5 44f2985f607e4c6b817e63236460674c
SHA1 33e1ce45d3b8f4fc24a0672a21bf03e7264812e4
SHA512 e6e2408b58501e083eb88d3fad559c35743bba46708debf42c4abd1fae713fac28b04d27068e6f2ef2732be2aeba76b3ceb85833a705dff282fcf31d16791f98
SSDEEP 384:DraSWXI8pxL6+YgpiqeHs0wgdKFkbCgHpPWdpwJrDp8Spo5nQHjHNJoa73eiU5i0:DBW4uxO+YgpiqeHs0wgdKFktKSl5/DRg
TLSH
T14513E0425600D2C3EAA61A30CE071B757BBAC2E6D715976F14CED0704FC3BC92E99B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bd9.rbs

Path C:\Config.Msi\e5a5bd9.rbs
Size 3KB
SHA256 a030b0434fdd3da57edd069de8e9d3bbf5be526b9a93d9420922e03dde361445
MD5 43d974a5790c1dcfd2de1d7f97d8839a
SHA1 a30e171926689683bb05eaf3496f21a65f42471b
SHA512 cc366abad65ee4f39a94e4c6019bf2d4481f89eaf6aadc04a22d9099f57e7f546765111c17bc14a285a7a2b9415c2f264b2205adf2de5643452556c12ce36d81
TLSH
T1FF71A9039904D2C2EDE63BB0D9571B2537B3C7EA8790938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a5bdc.rbs

Path C:\Config.Msi\e5a5bdc.rbs
Size 3KB
SHA256 cd15c861f3a65df603049cd8c8c860ee13929d89fa1b07123ad79177726d3eab
MD5 f854a3dd9905ff4f8dcdc3463e907f9e
SHA1 1f413c11ceb33d0a0032ba048491765b54ddda62
SHA512 fa9ca7c533290b4233a3863e626ac7af7284c3638dbf65470e9ec33a630a66c95d88544997be7799aae54e8208c693c41d4dece44014242bd740125f55599f64
TLSH
T1EF71C043994496D2DCA62B70CA270B6837B7D7DE9750438B458CC1740E877C5AFDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e5a5be0.rbs

Path C:\Config.Msi\e5a5be0.rbs
Size 17KB
SHA256 00c3b662008be23c767f5bdc559bb3f5a2eb8c0af9c03be8060d1b0b2ad58cc7
MD5 27c97cb31a70d5cb331bbc7ff9c53ce8
SHA1 e85398970c24f880f9dd87c1d906e0c27f7f84b6
SHA512 489246ccb7db11f999a1be490fd63947fad379628a5f84928746b647cdab089ed46303eec400eaf124a5a406fead69fc77d02eb42a0c880297fab69f08c309e1
SSDEEP 192:DrSKjlJRtoC41rAkIgrAkOH/EnwNWepJh:DrXoMwMFb
TLSH
T1C1820F02A60095D3ECA62B34C9971B683733D7EAD354935F01ECE1748E87B861F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5be9.rbs

Path C:\Config.Msi\e5a5be9.rbs
Size 12KB
SHA256 0f38b44a3e3d97e5893f16e076ad5c9d799f333f13788f993e46cf266474ee21
MD5 f4da252b14e84b0cdeff739bfa9437ff
SHA1 02e512391a561a51bb9c29bcb7730358c941b005
SHA512 d06be7c7132c1e6e7bc37caf32f81fcd4da2c5b1ac7e9ce71f57cd47148fb62ed834fbc9442e1aca606bc04a80ee726fdbe49766f9afe5de22ca4c9d010b35c3
SSDEEP 96:+MNp48xNpM0w7ztH8RIeDwYx3j71rR7c7QNpx0xcNpkFaxcTj7upSxrRjP86CNuW:+cRoYwaqrRzfCgPo6vgJ/l
TLSH
T18A52F2036B0585D7DDA51730DA630F247B63C6ED9324835B21EDE1788F637862E8D98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bea.rbf

Path C:\Config.Msi\e5a5bea.rbf
Size 444KB
SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
MD5 a883c95684eff25e71c3b644912c73a5
SHA1 3f541023690680d002a22f64153ea4e000e5561b
SHA512 5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
SSDEEP 12288:/VHbDqy90l5yQBggQerfhUgiW6QR7t5ss3Ooc8DHkC2ehSxPA:tbOqQbnrMs3Ooc8DHkC2ehSxo
TLSH
T12BA45C237B864CF2D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5beb.rbf

Path C:\Config.Msi\e5a5beb.rbf
Size 948KB
SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
MD5 2fb20c782c237f8b23df112326048479
SHA1 b2d5a8b5c0fd735038267914b5080aab57b78243
SHA512 4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
SSDEEP 24576:wmFyjHVMxBuwQLYucGp4iiqgNb3HoIbiIw:2My2yRgFoIbnw
TLSH
T1BE25BE12B982C0B2C57602B1152DE772197FB971443684B7ABD98F0E1DB46C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bec.rbf

Path C:\Config.Msi\e5a5bec.rbf
Size 331KB
SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
MD5 69004e08c1eb19fcf709908103c002fd
SHA1 d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5
SHA512 3fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76
SSDEEP 6144:+DyAKCgU1ninuWLJ/Coq6ElyFkc6csYR1wo:CKCg2uuWLJ/CoqHYFkc6Qv
TLSH
T100747D31BA85C07FDAAF4331645EE2BD20B47651ADB1C143BBD89B2D2BB3A42D431D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bed.rbf

Path C:\Config.Msi\e5a5bed.rbf
Size 242KB
SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
MD5 c7739dd4212d084d299df68f0a0debc3
SHA1 cba81d847d91bfea5c03279c0ca03fb1aacd4ae9
SHA512 5b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3
SSDEEP 6144:3SsS5fv6EATwqlGwyfDyodYI3ZubfW5Ub2PQu0+0:3I5fv6EATwqlGwyfDyodYI3ZwXh
TLSH
T193343C1272A0C9B9E57E16359B90A764605FB401CEE2E67F7DA88B0D1E713C0AD3472F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bee.rbf

Path C:\Config.Msi\e5a5bee.rbf
Size 117KB
SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
MD5 90419039c035404fb1dc38c3fb406f65
SHA1 67884b612d143aa08a307110cee7069bddb989a0
SHA512 e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414
SSDEEP 1536:UzysWjcd7xOvGRfXQFXqoRL47Ng2a+0zf5Ld/k1D0/LS+HDzV3g/LpL9qFEB1b:Uz97RkqI47eLhLdw0bHDzV3g/tpqFErb
TLSH
T117C37C01B2F08075E0BB0939AA75A6225A7F7E735AF1D8972F88445E0DB07C1E735B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5bf3.rbs

Path C:\Config.Msi\e5a5bf3.rbs
Size 26KB
SHA256 943ceadf26e1c3f03e2f673e086d905879f1435dfd183c66d34a6b37c58222cc
MD5 5b4f0e7eebbe38c7df3ac85bc5b8fbc4
SHA1 b92f20758ea10d4f2a9953010402cedab5eeaebc
SHA512 7a5ac299f9ab0467d65cf01c73995091e50d5e5670b06f3e875a16846925dfe45b1bee136a6bf70d60790484b5b56f0a1c9b473d8608f96e3bb12234f320e468
SSDEEP 384:hYdEv78exnS4EJyRN+F80SclQB+B+YT4bV:htvjxnS4EJymF80ScS4U
TLSH
T184C21F427B1092E3E4662B30CD6B17397772DBEA9711834B05DDE0344EA3BC52F9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c05.rbs

Path C:\Config.Msi\e5a5c05.rbs
Size 21KB
SHA256 e218a7d8984f0291c21d430fd3ef48e569918b956310012601e4a50b114ac80e
MD5 866e05f7e904aedea9001a2e87737ee2
SHA1 434b5bbb0ef231c05cca109fb7d3808c5efcc8d5
SHA512 6e5aa906d2b74d1dd984d17eaae472a5cdc839ca05124d656c29fb868233d717981de583e07f75115ef3f93d8bccf0416b2321e0af3bc4041d042088a7e0f5e5
SSDEEP 192:8fR9YPaAGQjQlXS7icYQhaeZrwqd/UschovL/B:8fR9FQjQlXS7icYQhaeZrwUSoT/B
TLSH
T1ECA2CD02775092E3C8672B30DD6B1B267B76D7E98321829B04ECE1384FA7B952F4654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c06.rbf

Path C:\Config.Msi\e5a5c06.rbf
Size 45KB
SHA256 5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
MD5 2f7c88c43a8966882ca89ce4981e3cde
SHA1 588bdeae6eab1f447771bd6963b5b3329196e686
SHA512 3f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7
SSDEEP 768:ddzvsXyPptLkrHyTby9XVLc9iiKrEBqrz:rz0XyPptLUHCbyBVLS+EBqX
TLSH
T119234A761BB8CA47D611453046D2DB83BB38E7995A11CF0BBF01F68E082A755FF09E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c07.rbf

Path C:\Config.Msi\e5a5c07.rbf
Size 45KB
SHA256 9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
MD5 70bbafa7c8b0aeba0e25e27c440a6038
SHA1 44a5e06229ae4f6ce6d3b2b57cb3b6050667def2
SHA512 2e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a
SSDEEP 768:oWbfucVI4Yr7kn4TJVM3i/EhKd9iBSEBWkR:VucVI4Yr4noVM3XhKf3EBWk
TLSH
T19223297A07A4CB42D9514A3006D6CBA3BA34EB95AF008B57BF02F6CD5C59385FF19D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c08.rbf

Path C:\Config.Msi\e5a5c08.rbf
Size 73KB
SHA256 550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
MD5 09936f1f2ad5ae9d0663b6e8709527c7
SHA1 f0e5945663e65405d94c394db83880f713295104
SHA512 3e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6
SSDEEP 1536:fVPidQr0UZqnn0BDw7Pu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf94uEj:fVidQr0UZqnnSw7Pu6V4aGCWRZX0bhpN
TLSH
T10373BB6143E98A19F2F2AF746EB45390BE32FDE6BE35D60E5610618D0871F40DE61B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c09.rbf

Path C:\Config.Msi\e5a5c09.rbf
Size 63KB
SHA256 d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
MD5 9becefa155c8c9f5ef5bf9d537c0a258
SHA1 4f33f6d08685d50ce799df6369cb5efc51673e12
SHA512 5e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4
SSDEEP 768:yTijcBEhCgyPj6B1CLPLNq5f/nWHBNheOU2fd5s9igOm27EBmoU:yGzfyPj6B8PLNYf/nWHNTdAhT27EBmoU
TLSH
T10C53DA6263FC4605F5F77F706EB586615E3ABCA2AD34CA0E1650A14E0972F40EE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0a.rbf

Path C:\Config.Msi\e5a5c0a.rbf
Size 72KB
SHA256 87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
MD5 30281f2891b6deae8c0deb122b5906c7
SHA1 43ed0c7bf45839ba07501c1013ba74c97b4d0beb
SHA512 cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537
SSDEEP 768:iqj0KnBU60E6rg/PKuCOCF3OKWRElJRZRIvp99idASXEBUoG:0wq60E68/PKuFm3OKWkRZRIl+XEBUoG
TLSH
T1F273825117F85206F6F3BF34AAB94A955E3BBC96AD39C50E4610618E0CB1F40DE24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0b.rbf

Path C:\Config.Msi\e5a5c0b.rbf
Size 73KB
SHA256 b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
MD5 b41aa9a167ac3d6c11b5c2e1e183c11b
SHA1 ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac
SHA512 de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8
SSDEEP 768:I26iNYajZELpjYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2Ne3j:INuqLpjQA2SCHj0jL+TEBeRE
TLSH
T1E8736F1163F89606F6F27F3069B846555E3BBC8AED35C61E1A00A18E1CB2F54DE64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0c.rbf

Path C:\Config.Msi\e5a5c0c.rbf
Size 71KB
SHA256 271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
MD5 2bcf9a28e5fe7a3fefd16a9c03d35dbb
SHA1 7c1446d8ca4d2c6890d62c02308daccb8be5475f
SHA512 445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa
SSDEEP 768:S3E6XaCyqbK15Md+igDGxNIlW3gyCQQQjeqS1hDsiiUWTV99is0EBnoX:Qass5Md+igSxNIlW37oETVx0EBnoX
TLSH
T10C63952263FD4A09F6F3BF306A7996515E3BBE56AD38C50E0650608E0872F54DE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0d.rbf

Path C:\Config.Msi\e5a5c0d.rbf
Size 52KB
SHA256 43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
MD5 34b5ae129703de4a4bb5f52f4306fdf6
SHA1 601ba6cc73cbbe6d7014519a885fde2c9e9c2fba
SHA512 016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c
SSDEEP 768:s8anVn/ZBtJxtr10/euKRHIWJ9i/wEBC1gnY:s7np/ZT/uMRGwEB+gnY
TLSH
T13533D7DD3AB8CA07E0E2C5300190F6D57A39FA449AA18E132F48F64F54566CAEB15F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0e.rbf

Path C:\Config.Msi\e5a5c0e.rbf
Size 52KB
SHA256 32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
MD5 f89147c034de186e3ab79326523888b8
SHA1 d3e6c00363a429eae066953f7c187e33c687ec6b
SHA512 d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe
SSDEEP 768:rCzO54LQTNyDraHniJNB2I7CvqV9iqoGEBNt1R:r951TNyiniJv2I7Cvq3xEBDH
TLSH
T111332A6716B8D903E4608575A7A3C7D7B7399680AA238E07EB00F2AD146A7D4FF10F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c0f.rbf

Path C:\Config.Msi\e5a5c0f.rbf
Size 69KB
SHA256 1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
MD5 d7f2e87512d19d01328840187fc7cb04
SHA1 7a312b677b76d7303e01da6064f1a5e0fb26c604
SHA512 8a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b
SSDEEP 768:pq/gFXOvijuqN9TMIVhtZ3FckD+Sy9iOLEB6C:g6XOvilhTVk9EB6C
TLSH
T14E633E5FEA7CD211E854C2701F9289D7207AB710672986CBDA8FBDAD602D33573285CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c10.rbf

Path C:\Config.Msi\e5a5c10.rbf
Size 4.2MB
SHA256 6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
MD5 293002e4332f01c74c2a843b5c638a90
SHA1 2e412f945ac4353b4908c87e31b847415b3ec19b
SHA512 49eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce
SSDEEP 98304:Gn+PuDLXJzBhxHJRAbQimwTyY04gXZDpxzecFLOAkGkzdnEVomFHKnPLO:HTyY04gXFL9FLOyomFHKnPq
TLSH
T1E026BF227EDC40A9C66F13319E6A763C66EFFE906835065763583F2FED712016A2D123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c11.rbf

Path C:\Config.Msi\e5a5c11.rbf
Size 4.2MB
SHA256 68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
MD5 e1629a36f15824346bb54a9ebe9b622f
SHA1 ee5d55315ffb351e24b7c918c82e6ce4ec17a645
SHA512 0301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb
SSDEEP 98304:0xNPc+4cnKyGatznwFDB0i+9G0eBF/8jFLOAkGkzdnEVomFHKnPs:r+9G0eBF/6FLOyomFHKnPs
TLSH
T13626BE02BFE980BAD66F13314E5D773CA6EEBE94E830474722543F2EF9712026929157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c12.rbf

Path C:\Config.Msi\e5a5c12.rbf
Size 81KB
SHA256 8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
MD5 36ca9bc41425660ad80f23933e6e9f1f
SHA1 3206186f932cd5948062a837b5fc2094ddb1c8b7
SHA512 a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5
SSDEEP 1536:GTF//j3V4q90rz6ggkZZKMXKq9Lf517jSEB4gn3:u/j5s6ggkZXXKsLf517uESA3
TLSH
T1DA838D45AA79C9BBE68F09327E6AC8425935D7D3AEB1FB031501E7DD5C873C09328386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c13.rbf

Path C:\Config.Msi\e5a5c13.rbf
Size 81KB
SHA256 d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
MD5 9b73043d5646be7b544e3ac3d49b7744
SHA1 a3eecb1a85c244d5428a012041eee947462e7a09
SHA512 8f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a
SSDEEP 1536:OAwg6/MxolUL+gWccikZZKzpUL/ybAGEBPiSe:k/MxolUL+tccikZAOL/ybAGEwv
TLSH
T186837D45AA79C9BBE2CE09323D69C9465139A7D3AEB1F7071601E7AC5CC33C093197C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c1a.rbs

Path C:\Config.Msi\e5a5c1a.rbs
Size 15KB
SHA256 8a3f567df33cfef39f50bfdbb87c03e3045f89d24fc8c2e1689c0ca4e5d81204
MD5 7ddd615d88da63946379dd0e46a1ad1e
SHA1 df51e34be714c97bb38b917c51ff1dca6bc07958
SHA512 3885d1dfbbc7bfc0146684473b21c165471dd66e2ad596098ee80b086c267fc87d099a212b6bfd91bcef481fc789e46b36b2ba2065d4a7f781d4556bf054638a
SSDEEP 96:yeRp55Rp/NRWT8R5eDd11xIjtknz0yWcW/Rp0cdzRp9OXw3Tjtkno8ijwUBQdogR:y8R017n3Xyin5f7e+nh18XTdy
TLSH
T12F720D02B98096C3E8662B70DD571B6037B6D7E5E354838B40DC92349F877E62F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c1f.rbs

Path C:\Config.Msi\e5a5c1f.rbs
Size 19KB
SHA256 680087959c4ff9f829953f2485f8f9ad9c5e952d805bd332ac98844cc3839e6b
MD5 ff60b365c76f6205b97dcfe82da2710f
SHA1 92d14aca5cd01ecac93cac30f58c7e996b839d50
SHA512 c7c5215d3af8c6fa28b4f1e0f71da75b9809460310140977e35242716957566eea6a4e9997d0d4d3621b82470e8bb905dbb5bc899f68ecae05a588675e1ee411
SSDEEP 192:y6Np7vL8JTUCUkJo4I3Jo4L40jnREzrvaf3Spp:y6Np7j8h1JobJouCafA
TLSH
T17A922D42BA48D693D8632730DE971B153776C3EA8351635B84DDC0344FA77C32F8AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c2c.rbs

Path C:\Config.Msi\e5a5c2c.rbs
Size 19KB
SHA256 1ea0c7913837cd180fbaed53807e35f93c7029ff84bd19bb80a0e165db2bb3bc
MD5 7f995d3f17b00b37a29167d0f859ffee
SHA1 e7d20a7f675cd6be91fe86740a305e1b5f204241
SHA512 66c4782d225298fd01a4c9517dade3b172d9f8619bb497a6eea20d0e3c53a1944976c3ea3c3e4ceac401c84835cc75ec0df091f17b1770564c588d9f032d237a
SSDEEP 384:Q6RzgmiMawmn28I1S9HXVZFbLQPO6cOXagLIkR4/G1Vft:Q6z1iMawmn28IA9HXVZFbkPO6cuagLIG
TLSH
T1A692FF03B64499E3D8B62B70DDA70BA57B32CBE59361434740EC85384F933D63E9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c3b.rbs

Path C:\Config.Msi\e5a5c3b.rbs
Size 20KB
SHA256 374639f949bd6e405b724c826619fa263eb54977549097a6f84c28eac5f43f59
MD5 f688ddf27f86f1a9ae1f0de7c88e5d6b
SHA1 c7c4589ba13b5bf86190f6c2004d3f9bdc98e365
SHA512 e787402a5e0189770967c169f15e78f1e8039233dde81556dca2b837037c027f7ae0ca506f82168c91d5ae1c14bb8a8ea4fd1dfeb351cb484b3d249aeb0c9e94
SSDEEP 384:QiyGk0Ve2SD4QsUh+rCm5iJLSJLk6mQ9S+UW:QXGk0Ve2SD4QsUh+mm6YA6F95n
TLSH
T1EC92CB42BA80D6D3D8A62B70CD571B693736C7EA97A1534B08CCD1304F873C65F9E98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5c40.rbs

Path C:\Config.Msi\e5a5c40.rbs
Size 730KB
SHA256 d6700892ee55167f4f281e657f80a86ba32e277e02a14ccc7775daee4cf3bed8
MD5 ab2a95c7adab836fa05304f4a27df1dc
SHA1 7e88c26fbba74d08a631afd6c881718c50f39017
SHA512 f074ea567a8dead524283b2fb1274d7b7bc57fa749fce4c4757f0e7493e89681618a8f989da005712d105b5ddd09224f1d2211f20e25b44b25a645787e99e46d
SSDEEP 6144:Eo6drDjORLIKuRy6QK9/NMR389050RGEkGqv3DQkgRMP7SCIS27RI88/HnZrGpaJ:DAyluAN89BycS5IEZysh7L
TLSH
T138F47342B14092D2D0DA1BB0C5A73F197F2BF6AA4AC2971F401CC1784C97BDDAD5EE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_6d6ca4dcb7d7eb8a37292bad86c154c9_elex_swisyn_wannacry.exe
Size 19.3MB
SHA256 05d2d3fea6ef2dc0a4fd069208d1e1d1024cd0652e71b7ddbd4c4a33bd3babfb
MD5 aa13dcf14573248d0b5a89bc7929249c
SHA1 f58c7295529dc40346394c800ec7fbaba2dbaa8e
SHA512 e883cfd7bfe2f1fd32af1d1e0dda26c42f2b774f0f28c6824688de19fac64755adca927fe3eb0f8c42820dce3aea47fadabbde482be072fb05690f634de01d98
SSDEEP 393216:21A0F64RpEuaQSiHYjORB6MzWy08TQTy5ccxSuo:Kh//3RBDWyGy5Bxpo
TLSH
T1D01733B11A49417CEBE0B1F54A4AF49672FCF9B8E5D58D8930F07D9EA4DE4204EE212C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi
Size 196KB
SHA256 9e51555009f1d7839c090ec50db52ec755a870a14caefe78ec4abe984dfac5b8
MD5 3c189067ef0d1fc8d42a8ff6a151f040
SHA1 78d09605b608a7d58ac55c86a5f3176345d07590
SHA512 bb313896bae8bdfd1d3435d349e0d7911b43fc148306be09a718b446b7577910d29242a7d289a65800559884002e1533bc49063a399656e62bf81d5c03381d8a
SSDEEP 3072:BdoNmUU75uXwwOTMYRradauqCcJg95fOdi4tLw3mmqyyyyyyyyy:BdQSRWd1qdmDmmqyyyyyyyyy
TLSH
T146145B42B653C133E8827330156E673E3F3C6C645B61858B328AB69D5F73AC4963A3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 33KB
SHA256 2c7fc692833c2b1263dde90882c3d0e4c569b1f59666c48fdee9b4fe77009901
MD5 d498ccbc73880c8e6523bbf63620eb94
SHA1 6a0a96908201d5649c2b43eb76fc01dd74404117
SHA512 14143f78c739b56d27274c7833e17c12189421073e0003e34341eae8f2b03c8660c6f849633e6b38af9f3308afd5252ed98d970a4a8e50cd2df786998961978e
SSDEEP 768:4Lkz7J+PFJE7y8R05qOn3RALfiPb4TWipwfz3Kw/o9L/Y7jsCyyEMLBE2SEAgEEc:/LfisTWipwfz3Kw/o9L/Y7jsCyyEMLBY
TLSH
T155E295197D48523675E083B6E32495C2FB2ED5B28B30E78C7CA6C8B074AB116D07E7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 984B
SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
MD5 5a83a0d789ed6f02421d44bdccd87cd3
SHA1 152fbeffaeac96dea12cdffc8b55e76502f4358a
SHA512 c5cb0eebecfdfe4bde5144155e3f4fde77b468e674d3f3eb22a9c1a1e8a4dc208701e4a88515dfcff0d794e68e7f0ae083bc49ed2fdf652d390d1d16cca28886
TLSH
T17211D69255244152B9B321000B2749612FB59F2A31D7CA1A45C9D9A3772BFCFC4AD38F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5A47.tmp

Path C:\Windows\Installer\MSI5A47.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6496.tmp

Path C:\Windows\Installer\MSI6496.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 097d6c569c7ad19266d5a05924890acf6dc823bef6ba70a3994cbda2e12c59b8
MD5 a9697ea8f51d288a0ad2cde5b397a98f
SHA1 6b67a67f74865408a53ef1b8ce3d18e6cb59b8e1
SHA512 5a478e5a8b9d9c174259d2e20ef5025c22a248b955db95a78a3e48df1527f7dee0fcea89dfbb7b5a912bac417d37fc4fe86bb597bfea5bfa54407b365312bfce
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0HHHX8ii:UVqoCl/YgjxEufVU0TbTyDDaleHHH/i
TLSH
T179D31927BE00682FD422CAF06CA9DB29B9662E361FD17D5732A2BB04763550775F020F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 5f6d79d72a5ac38a17505e96ead45001208c782705fd210815518dcdc6d1b66f
MD5 0617a97d8e1aa1e8fb92f3434233b29e
SHA1 f0a54c1f05a74e7d413bdd2113c7db062c451602
SHA512 136e564eb8f0f392883b97cf3394d702117257673e3cd0d57e23f14ae5509077bfc08f92feb726c4f1e18edb85ad9af58065d48a61009894290529d9ddb1cb80
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0HHHX8ix:UVqoCl/YgjxEufVU0TbTyDDaleHHH/x
TLSH
T1A5D31927BE21107FE922C6F0D8A5DA2EBD256F3A17B1AD476256BF003571503B6F021B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 fcdedff5f820dd9b6481245fed36cfe3a58555a89b486a6b1f93d8bd9b5710bf
MD5 05c843c129365d05a92ca9fd2312a325
SHA1 b620f6e4cef82f2812d17f000d2e9e081b4e2bea
SHA512 f70f38a3768f48b89c2ae985ed824a078cf49df996b164551c479a9b9f0520cf620958b0a0a07ea6c4999c34e3fe77579add1b02e3be1cd9d9cd8e6ae2b80633
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0HHHX8ii:UVqoCl/YgjxEufVU0TbTyDDaleHHH/i
TLSH
T1F9D3F827AE10202DD5218AF52CB4D75FBA226F391BA1AD0773A2BB0135B355376F421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 fb24947226bbed152091a7d0d7141619e7b516fb7e2aad34b48a7d297df6b631
MD5 ae2820b884ac05a1d1c7ca8e28b4a0d8
SHA1 e387ffb0795d4ef9c60ba3931af2f55156f36721
SHA512 a2bbc20a8ae0781d6fe1e1952def2efb8b9e150f4abf58658430ae4de93514cbb0af0f45b257660dedd01c7a609b0f26fd8646aa21f7401f34f1a55ac39ba906
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0HHHX8iB:UVqoCl/YgjxEufVU0TbTyDDaleHHH/B
TLSH
T108D31923FE01A02FE41385F568E5DAADFA211E2A0F985E4363A6F708217654779F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{3338A51E-F236-48E4-AC14-04214199AC69}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{3338A51E-F236-48E4-AC14-04214199AC69}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/504-908-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1720-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1720-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2532-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3100-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3444-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/6072-906-0x0000000000400000-0x000000000041F000-memory.dmp

Download