floxif | f4fc360a9a23e798e671fa66b5a26367c740dc9a2e62b3b6bc838357949970cb

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe
Size 7.3MB
Sample260628-2dmtbsgt3j
SHA256 f4fc360a9a23e798e671fa66b5a26367c740dc9a2e62b3b6bc838357949970cb
MD5 58f88ae6811d375fa948da5ba2936fe3
SHA1 3b8f903b495c28d64092f70c1d25beebbd32e00b
SHA512 077a36da355732ed1411145fba8880335e848b87be2475f81102a69f5a3d735f5d41b28d80a09288ac09d6550f29868fb4932803131f76932e2c4172a9053aec
SSDEEP 196608:v5kF+vGrCIDuZMCvMDoiKq5ZCUixN8K0QS6XtdzRtmkD9lCX7Sd:v5kMurjuWrMxIYU2J0QS0td3rlr
TLSH
T1CA763311379543F9C6C86430654EF7A029D4E6AC23BA05D7E386B901BD393C6EABE0D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution floxif spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x00110000000118e9-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/6700-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x00110000000118e9-1.dat	UPX
behavioral2/memory/6700-423-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4500	powershell.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00110000000118e9-1.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
2076	TeraCopy.exe
1084	updater.exe
252	updater.exe
3904	teracopy4.0.0.27.exe
460	teracopy4.0.0.27.exe

Loads dropped DLL 16 IoCs

pid	Process
6700	2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe
6216	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	teracopy4.0.0.27.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	teracopy4.0.0.27.exe
File opened (read-only)	\??\Q:	teracopy4.0.0.27.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	teracopy4.0.0.27.exe
File opened (read-only)	\??\I:	teracopy4.0.0.27.exe
File opened (read-only)	\??\R:	teracopy4.0.0.27.exe
File opened (read-only)	\??\U:	teracopy4.0.0.27.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	teracopy4.0.0.27.exe
File opened (read-only)	\??\W:	teracopy4.0.0.27.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	teracopy4.0.0.27.exe
File opened (read-only)	\??\L:	teracopy4.0.0.27.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	teracopy4.0.0.27.exe
File opened (read-only)	\??\M:	teracopy4.0.0.27.exe
File opened (read-only)	\??\V:	teracopy4.0.0.27.exe
File opened (read-only)	\??\X:	teracopy4.0.0.27.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	teracopy4.0.0.27.exe
File opened (read-only)	\??\P:	teracopy4.0.0.27.exe
File opened (read-only)	\??\Z:	teracopy4.0.0.27.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	teracopy4.0.0.27.exe
File opened (read-only)	\??\D:	teracopy4.0.0.27.exe
File opened (read-only)	\??\H:	teracopy4.0.0.27.exe
File opened (read-only)	\??\S:	teracopy4.0.0.27.exe
File opened (read-only)	\??\Y:	teracopy4.0.0.27.exe
File opened (read-only)	\??\M:	msiexec.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6700-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x00110000000118e9-1.dat	upx
behavioral2/memory/6700-423-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teracopy4.0.0.27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	teracopy4.0.0.27.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Control Panel\Colors	teracopy4.0.0.27.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	TeraCopy.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\ = "URL:caphyon-advinst-updater2"	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\URL Protocol	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\shell\open\command	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\shell	updater.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\shell\open	updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000_Classes\caphyon-advinst-updater2\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\updater.exe %1"	updater.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	teracopy4.0.0.27.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5900000001000000120000005200530041002f00530048004100310000001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3496b0000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef45c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	teracopy4.0.0.27.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	updater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 5c000000010000000400000000080000530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000004348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c7016114000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd97f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	updater.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4500	powershell.exe
4500	powershell.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6700	2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe
Token: SeManageVolumePrivilege	2076	TeraCopy.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeSecurityPrivilege	4624	msiexec.exe
Token: SeCreateTokenPrivilege	3904	teracopy4.0.0.27.exe
Token: SeAssignPrimaryTokenPrivilege	3904	teracopy4.0.0.27.exe
Token: SeLockMemoryPrivilege	3904	teracopy4.0.0.27.exe
Token: SeIncreaseQuotaPrivilege	3904	teracopy4.0.0.27.exe
Token: SeMachineAccountPrivilege	3904	teracopy4.0.0.27.exe
Token: SeTcbPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSecurityPrivilege	3904	teracopy4.0.0.27.exe
Token: SeTakeOwnershipPrivilege	3904	teracopy4.0.0.27.exe
Token: SeLoadDriverPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemProfilePrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemtimePrivilege	3904	teracopy4.0.0.27.exe
Token: SeProfSingleProcessPrivilege	3904	teracopy4.0.0.27.exe
Token: SeIncBasePriorityPrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreatePagefilePrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreatePermanentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeBackupPrivilege	3904	teracopy4.0.0.27.exe
Token: SeRestorePrivilege	3904	teracopy4.0.0.27.exe
Token: SeShutdownPrivilege	3904	teracopy4.0.0.27.exe
Token: SeDebugPrivilege	3904	teracopy4.0.0.27.exe
Token: SeAuditPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemEnvironmentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeChangeNotifyPrivilege	3904	teracopy4.0.0.27.exe
Token: SeRemoteShutdownPrivilege	3904	teracopy4.0.0.27.exe
Token: SeUndockPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSyncAgentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeEnableDelegationPrivilege	3904	teracopy4.0.0.27.exe
Token: SeManageVolumePrivilege	3904	teracopy4.0.0.27.exe
Token: SeImpersonatePrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreateGlobalPrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreateTokenPrivilege	3904	teracopy4.0.0.27.exe
Token: SeAssignPrimaryTokenPrivilege	3904	teracopy4.0.0.27.exe
Token: SeLockMemoryPrivilege	3904	teracopy4.0.0.27.exe
Token: SeIncreaseQuotaPrivilege	3904	teracopy4.0.0.27.exe
Token: SeMachineAccountPrivilege	3904	teracopy4.0.0.27.exe
Token: SeTcbPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSecurityPrivilege	3904	teracopy4.0.0.27.exe
Token: SeTakeOwnershipPrivilege	3904	teracopy4.0.0.27.exe
Token: SeLoadDriverPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemProfilePrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemtimePrivilege	3904	teracopy4.0.0.27.exe
Token: SeProfSingleProcessPrivilege	3904	teracopy4.0.0.27.exe
Token: SeIncBasePriorityPrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreatePagefilePrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreatePermanentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeBackupPrivilege	3904	teracopy4.0.0.27.exe
Token: SeRestorePrivilege	3904	teracopy4.0.0.27.exe
Token: SeShutdownPrivilege	3904	teracopy4.0.0.27.exe
Token: SeDebugPrivilege	3904	teracopy4.0.0.27.exe
Token: SeAuditPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSystemEnvironmentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeChangeNotifyPrivilege	3904	teracopy4.0.0.27.exe
Token: SeRemoteShutdownPrivilege	3904	teracopy4.0.0.27.exe
Token: SeUndockPrivilege	3904	teracopy4.0.0.27.exe
Token: SeSyncAgentPrivilege	3904	teracopy4.0.0.27.exe
Token: SeEnableDelegationPrivilege	3904	teracopy4.0.0.27.exe
Token: SeManageVolumePrivilege	3904	teracopy4.0.0.27.exe
Token: SeImpersonatePrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreateGlobalPrivilege	3904	teracopy4.0.0.27.exe
Token: SeCreateTokenPrivilege	3904	teracopy4.0.0.27.exe
Token: SeAssignPrimaryTokenPrivilege	3904	teracopy4.0.0.27.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2076	TeraCopy.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
3904	teracopy4.0.0.27.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe
252	updater.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2076	TeraCopy.exe
2076	TeraCopy.exe
4624	msiexec.exe
6216	MsiExec.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe
2076	TeraCopy.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6700 wrote to memory of 2076	6700	2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe	89
PID 2076 wrote to memory of 1084	2076	TeraCopy.exe	90
PID 1084 wrote to memory of 4500	1084	updater.exe	91
PID 1084 wrote to memory of 252	1084	updater.exe	93
PID 252 wrote to memory of 3904	252	updater.exe	94
PID 4624 wrote to memory of 6216	4624	msiexec.exe	96
PID 252 wrote to memory of 460	252	updater.exe	97
PID 252 wrote to memory of 6172	252	updater.exe	99
PID 6172 wrote to memory of 7068	6172	cmd.exe	101
PID 6172 wrote to memory of 6908	6172	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_58f88ae6811d375fa948da5ba2936fe3_coinminer_driverpack_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6700
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TeraCopy.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TeraCopy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\updater.exe" /silent
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new-object System.Management.Automation.Host.Size(1024,50);" "&""C:\Users\Admin\AppData\Local\Temp\ps195E2.ps1""" 2> "C:\Users\Admin\AppData\Local\Temp\ps195E3.txt"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\77e5ddde87b4f30689b283a672c9f780\updater.exe
      "C:\Users\Admin\AppData\Local\Temp\77e5ddde87b4f30689b283a672c9f780\updater.exe" /install silent "C:\Users\Admin\AppData\Local\Temp\77e5ddde87b4f30689b283a672c9f780\updater.ini"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:252
    - - C:\ProgramData\Code Sector\TeraCopy\updates\Update\teracopy4.0.0.27.exe
        
        "C:\ProgramData\Code Sector\TeraCopy\updates\Update\teracopy4.0.0.27.exe"
        5⤵
        Executes dropped EXE
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Modifies Control Panel
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3904
    - - C:\ProgramData\Code Sector\TeraCopy\updates\Update\teracopy4.0.0.27.exe
        
        "C:\ProgramData\Code Sector\TeraCopy\updates\Update\teracopy4.0.0.27.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:460
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{591EBD44-A7B6-491E-BE02-6A863257EFE1}..bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6172
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\{591EBD44-A7B6-491E-BE02-6A863257EFE1}..bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" cls"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7442FE0AA99FA65E1A843EEDE96AEED6 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teracopy4.0.0.27.exe

Path C:\ProgramData\Code Sector\TeraCopy\updates\Update\teracopy4.0.0.27.exe
Size 14.6MB
SHA256 36fbcc347d3cedfaebe3d64dd8dd9b6df351e59ef783c8241ce21df255bddad4
MD5 5ba5033c28094c75badaee387832d0bd
SHA1 f98109402bd5e8c131a297bf94725a7716c5f46a
SHA512 c157f435ab4605640d0fc9ef551dd4fa55c02b965bdd2214fa5a656f7a09022007ffe068d94402e6301e819579367d9948b9e23a918078bed1edce7e80f9bf7a
SSDEEP 393216:QOt5LgwyaPEejK9Z6aPriF9qiIfSFTzpv4keu3fioIhr0M:Xt5LgwydejK9Z6ajiF9bI6FfpvQ5Bhr
TLSH
T17EF6F121768AC56AD46D06F05E1C9AEA922C6D370B2184DB72EE3E5F67744C31633F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

teracopy.aiu

Path C:\ProgramData\Code Sector\TeraCopy\updates\teracopy.aiu
Size 1KB
SHA256 770bf9d926e8b307b35558e867c623a88dca8c0359135d26fdf4b58e9862fef4
MD5 ca40e05b7d4de114c6cf1b4b4c7d807a
SHA1 584fb6f5d9859f4ee96a500f9f35bc45fcc932ee
SHA512 1a4868f525cdedc8b185d1ef1e27acf64ff22a687aa2c785a3cab66d38a9b71d8b4abc3a3fde1bfed4e228c572c95a5b63fcb8a51499e9d0ec7bbd6d73e65444
TLSH
T134210FBE651923B4085B5B5361AD71803B1F51988F40A298E19BC1CCE6918BCE3BB0F2
MD5 SHA1 SHA512 TLSH

Submit Download

14DAA0ADAD85A916E324346F2AF71ECF_7B47C1F94169DBCC6DB823188687B33D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14DAA0ADAD85A916E324346F2AF71ECF_7B47C1F94169DBCC6DB823188687B33D
Size 472B
SHA256 4c86ee178d962950b2c788ef44fc3a03af668724536eb3c9fa2460070651918c
MD5 35c6b22b291bb2ec477a4245043d13ba
SHA1 d4d8f54cfe770032fddb8fbf1075f63361305141
SHA512 10c20417bc2541459a434f8096718aebc9565250de5584af019ea1c1182b33b89dd20fe0bbf9895a5df4c692959895694bd9de051ade1f35772a4d912cb5dc2f
TLSH
T1B3F0D4EB0D7590E8FD469453DEE59FFB22C8D7182D741916213005DDFB01B96612E04C
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 441b1c081cfbd8e81a0ec51f89b440fcd0954a082a9898f7e720b6675d073a36
MD5 769af939f662986bc4d883b8925f9b82
SHA1 83322bf996787e7747a3b4ba43a8c310285f330f
SHA512 49ed1649c8c2a3be050bdc20b9dd2420f4348acc976de573664c71c74a20ee1750edc6ea0a0ef5b5bc88d6c8aa70e64b11aa701e236f894449e6c489639740fd
TLSH
T1FD31E9AA82A42D85FF521E96BF86C63BB8F4478038881C267127C0D80ED43545F0A50D
MD5 SHA1 SHA512 TLSH

Submit Download

14DAA0ADAD85A916E324346F2AF71ECF_7B47C1F94169DBCC6DB823188687B33D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\14DAA0ADAD85A916E324346F2AF71ECF_7B47C1F94169DBCC6DB823188687B33D
Size 406B
SHA256 561bffe784a3793cd41e48f6307070472a68f229a891215f146777ee9661529c
MD5 4d4cf2eac9c109ed362b5bf2316813e9
SHA1 be1a34b05c96ad84f883aa547919ef5ced8d65ed
SHA512 b0a54652b2d3c3fb635e1f69301c8bbb4cf48f6ec0f8373bd091bfe0485fc14bbe4d9b0bb9ba84d6008b2867ca9bddb75b885258420a38d0ceb63f993d8cc203
TLSH
T189E0C61836FF800EF0E5DEBF03C47BD1496BE258800443E22AB0060CAA46E011CA1661
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 221fa754e68ff2ec03b77a3e5f89579e1f1b265b4b663fdeb8d62f06f84a58d3
MD5 1e4220f7a299cb6f5a935c648be352f1
SHA1 6e28074f25c927eff3bf5040e99fc593c9f17033
SHA512 2799b908cb598822b5929375ab8e367282d195e25e7416daf19157fe0fcd41a3123fab93fa57a03a0f1422c0a01da18139f31752e73c324c1b114d5003bb6c23
TLSH
T1BEE0C6046979893CF030CA3A4ACE7863037FE604300502F00AA05B0EE70AF082D929F8
MD5 SHA1 SHA512 TLSH

Submit Download

updater.dat

Path C:\Users\Admin\AppData\Local\Temp\77e5ddde87b4f30689b283a672c9f780\updater.dat
Size 1KB
SHA256 5b3bcb22ba18924668461b287d5ed4cc14e213705f42d17f414bf60fc980c7c0
MD5 9caed5aa2acc4ca4c23a97a7ed4a7353
SHA1 19447b5ce16d642f43e1d70df577c86b9799c3c6
SHA512 0ef87eff3ba5471cebc50bfc9f8f1942cb1bf3c91b4588413ffc4ba9aaa8414f2dad0e99519b0001f0f526dd13739a55bf3c6841a49de5907c8672a665d201fd
TLSH
T1C23110FDA66D13F400671F9720F776856A1F115D8F8096A5E19AC18CE6908A4B3BF0A1
MD5 SHA1 SHA512 TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\77e5ddde87b4f30689b283a672c9f780\updater.ini
Size 874B
SHA256 f062ebdb2a229fa9acc5e669759b0f691d592230ed2b1f72f9ae15a91aef4952
MD5 5965c6b2438a92bf064f48b266eb2734
SHA1 2a45c33b6f646ea6f8ac5c24a220676f38cadbb1
SHA512 6138fa2c7bb2a44ec7dc6756def78e641b1c9c4dafab881b2d9ba9d08b9947c040666111c61a6c92d14fe0250b4e6efb881ed6dcb8864968bad2895031215f53
TLSH
T1D31180637AE82101F7F77E94ABF690612ABDB5307D09E50C91D0424D0CB3F159A62B66
MD5 SHA1 SHA512 TLSH

Submit Download

PowerOff.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\DefaultData\PowerOff.cmd
Size 279B
SHA256 50c0bc8a1097a40a940133fda83e77d109e1c30fe385e142c646ccfaec9bd4bd
MD5 f95082b2d55f940ffd919c87c3432c38
SHA1 1adaca6fc0a241aa405c67eeac4513ab204e98de
SHA512 bff12129c00419a030e1379ca2497b725feb78f6dff6ef7a801af887c405871932310bd62c7f02e2355faf50b83924fb4aa3e3e1027a69e5835f851033b95089
TLSH
T1F6D0C2A82F502ABC99003A86FD6C82144472A2495D2B919D505C3E8C67692D2B9B28D2
MD5 SHA1 SHA512 TLSH

Submit Download

Blake3.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Blake3.dll
Size 159KB
SHA256 0db71f38e0e64cd855c9bcf5b8f4ac0bb9dfe45e27c18f9aad949fcee946bc9b
MD5 48c5198ca37878b9b5ddb89a2e90497f
SHA1 49efa09453b2867ba822811fce25d595de042e28
SHA512 168743b0ab0336ae2bb8e9a8113f130b4bfded41ac8586d101b7e3f5fad9d9beeb62aa0c3a22d785e03ebe958fc76146fd84764d3941dea1ef3fa6d381efafd5
SSDEEP 1536:WmahBzTzZWMhFAF3Wx7cT3lLNa1iM+3SuxwnXL7pFVlYpDJgYUsW8id09dlafZ/k:83977C3l5awh3rwb7nVl8CVMAfAv
TLSH
T142F3491CB0A684E9CC236279C5774725EF34766C1354DAEE038A43D6AF673E01E39EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TeraCopy.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TeraCopy.exe
Size 4.6MB
SHA256 4f4e3c5d265c7350d56638be72413e62a0d48a94411da68836dd630e1e61391c
MD5 0599e55c4eb4729fa508e2a1ef36ba2a
SHA1 12635b1ccbec25c75d858c1729240e1cef8f60bf
SHA512 0078aeffb216a26737271eed570917d01f1ea437cbb27872ef9f633cc5cbb03c4022349547b4190c106001db5c79320970749b67f54154ca593c42f595c30537
SSDEEP 98304:n8f+vVySEThuy1XPIANOXWfykJ0IEEf7NtdRM5mjaL5XY:n82E9TQwcXWvL9fBtdROBXY
TLSH
T13926E164EB05DD78E14EF074E1324069A472BC3216E3442FE03FBD2BE5B6A519FE9618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\updater.exe
Size 1.2MB
SHA256 dc9d76355354fc0b3d5d7176f97dbedf72526d81e4b93ad8231e4f48f0020708
MD5 d8b22f90533e53ac0b219133b28aeab4
SHA1 3204e11f5ccfbe5bb5441a6f7f43f8cdc16983ea
SHA512 f606a91e811a3dcf2eb5fde0dda4280adf641b19087f6c491a4f817a45eea88a8650c9f1daa2b1af12eccf59d19a0aa8e83cad0b028df94df16b4d5be428925a
SSDEEP 24576:9nis83Z1dLLBOHKL/fZa3mHxTDfXkfoIvj5+lymrBZwshcSI:ks83Z1dHB/fZa3mHxTDfW/vj5symrBZ0
TLSH
T1BC456B313647C03ACA6200712B6CDAAE5278BB350F7358DF97E86E6D59B08C113B5F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\updater.ini
Size 397B
SHA256 fb45dedf3cc06ee62a5475424a08fbb6c5a164914242de04f35b9796b42e50ac
MD5 8e70fd29d0458f4f3073e50fa83f2d27
SHA1 70cef6902ff3f14bbfad8c6eb0db3e36c3285f71
SHA512 0692ab0b4ed85a2ea6a57565d66c11b07b284407adc10f5b02a61a51028adbd89b4a1cd1e13e5d7b066516f8df475a701999470bf082dc90ae0c9e6a1241f983
TLSH
T185E02BEF0EDE926261635E165359C4111556D38E9F62063F85A4214EAB84D44161A13F
MD5 SHA1 SHA512 TLSH

Submit Download

xxHashAVX2.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xxHashAVX2.dll
Size 280KB
SHA256 6ba89dbdf71f4dce480c206be45f47faac467d185845a9bcc093ae9facd6ada1
MD5 11d0f3d7776c7d6d1b7bf5433c4aa31b
SHA1 b6a2c78f8549a0496005cfa60bae91ace8d5d6e9
SHA512 2a5d95da95e0fb087e4181ed0bef0344b16e2a3d75d8e30f6f8fac56cff6093b2924fe976dc9e5cc7af320ff18ea197419312764af237981279a51b46664c596
SSDEEP 6144:I7+AShyBMgBhzhNngqFg+3vX6DD0VgK5pbc0mhyK:I7cyBrg+3lTJVK
TLSH
T1E4542927B693CCBAF25A823B84DDCA009433B3650371F2EBD4C2426EDAC96F11D79655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSICE3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSICE3A.tmp
Size 1.1MB
SHA256 021242629aeef982a9c33846cdaf5cce15f3e4eda1c12fe2360797837089c29a
MD5 0c48d9c98d163cd4e852b8ae0c2307e2
SHA1 e6f0ff0cac178eb20138dc3f6ff0dd18faa7960e
SHA512 45632223ef5dc76bf68d69137b89c34b9740ac7189cb00289d94828087a098f999a38e5eb9e91e55627dfe16f09e7f71124f2d1cf4169caeed2618e6b6defa89
SSDEEP 24576:Xa/JMKINr6mHLb9K70xMYpPtOby4eMh0lhSMXl25etobSst+qXkh:XaxMKINemrgobVOby4exoeESst+qXkh
TLSH
T1D1456C713A8EC037D75E1BB06A3DCA9E912D7DB90B7188C7A7D86D9A54704C21732E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hydynvwp.xte.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hydynvwp.xte.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ps195E2.ps1

Path C:\Users\Admin\AppData\Local\Temp\ps195E2.ps1
Size 2KB
SHA256 53362a95cf1af59e06c0723528dde6bfe7d76aab760cf4cd35d61b897dda1755
MD5 93e66740659d961bc6671c61d5a8e889
SHA1 227ba51248fe493961ab4b66aeab120df63f02e6
SHA512 5105319cee3230632c2b882f99d4059e780be4ff0e22de9afa4a3530b4a395a086679c036d06e3cf8c5a02a559449b22957f99d26c5220532aa3f4c99c3e8740
TLSH
T1E751D54363FE0748F2F36F4DA9BA35144E3BBD6D9834C66D02A5554E0AE2E009960F77
MD5 SHA1 SHA512 TLSH

Submit Download

ps195E3.txt

Path C:\Users\Admin\AppData\Local\Temp\ps195E3.txt
Size 976B
SHA256 5845dc5806e47570945d8a4a2ca6d1f213ee3598e79166c08ca7f58781bd46f2
MD5 2be3cc7ccdd81c314bfa9968048f3019
SHA1 18308821dd63c9bd5429338ceea21e140afd4244
SHA512 8ec987ce267c49aa62a1f69a3372ee8f8b2df63c3320c0f3360385a7706787923b1f5f2222d22c291caf4685d0897c8a8e79984c28ecf738e19c63f007943ab7
TLSH
T16B11525367FE0AC5F6F32B5D99BB70240A3B7C696839C51D21494E4D0BA3D04CA90BBB
MD5 SHA1 SHA512 TLSH

Submit Download

{591EBD44-A7B6-491E-BE02-6A863257EFE1}..bat

Path C:\Users\Admin\AppData\Local\Temp\{591EBD44-A7B6-491E-BE02-6A863257EFE1}..bat
Size 663B
SHA256 0bfdd0494da76006038749800be2a27063a7723b6eb0e3d3eaa5923b321cf77d
MD5 898cb29c6cde653fe203f9b767b7fc79
SHA1 d95caec68f9a5331f51fef1df10ae32e32639fb5
SHA512 3cd3679feebc6d9bffdd573b76af109a8e3db690be1e5da7dbd37f00b1df788dc44a149ca2ab9aee379002a292ccd139dbf51a6c3cfecc8e9512d3fd62f64d08
TLSH
T1D701D412478F832508F0154F0FB52B8EC13528BC2A976B304BF1A70D9A8220EA9D73C2
MD5 SHA1 SHA512 TLSH

Submit Download

teracopy4.0.0.27.x64.msi

Path C:\Users\Admin\AppData\Roaming\Code Sector\TeraCopy 4.0.0.27\install\47C1826\teracopy4.0.0.27.x64.msi
Size 5.8MB
SHA256 ee940850456cd016fe1b8545eb6b3c83f9ffbe5e6b0f2c597a8a52b7f8f1bba9
MD5 88548e60cf627437070e5fab21771a18
SHA1 f358c1caaaab89ea51f3365ba39d0396406c01f3
SHA512 77712033537395b8d397f3aa9c8c52dc9d852504f1a66365bf0dffb8094e419c06f61e7dd36647caed5498b4047f117d044a251c30e825a2ca7f28f1287c8481
SSDEEP 98304:ZxMKINemrgobgenJSBkRYSq9mGUm8i4Rm8Y57KBpUbx8:ZmKuemuuIBqYSqp8i4wJ52Ebx8
TLSH
T133567B21774AE03AD51D8EB0693D8BFAD12CAD65BB6100CF63C8796A9D303C35335A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Roaming\TeraCopy\Options.ini
Size 1KB
SHA256 f72897f82e5562ce0a4e6a146cfc296a5cb82017850f8845fbb2eead0f7634db
MD5 6532c237f370afb7009c47d1b714d6d1
SHA1 db46add4a669ca875088e5e5be79435c2d5d749b
SHA512 3b28c7bbabc340e3d2d17a455f26f4abe84593bebe04a017deade8c72c46b17f88fb64cc83d16e909c374f589fc2c8a9d7881cb40e8e8831252f31772557ba09
TLSH
T19E21C4FE864C42EE66E5B0D254B0CAFD11E3C55404123551ABAD7852BF9DCC5A06D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Roaming\TeraCopy\Options.ini
Size 1KB
SHA256 3dd79c7d7f27cb760cb67590eac85d2fcf0febb9c43bb5b6723bc0cedcd37033
MD5 7b80acca7a46d9e1f85600412c7872fe
SHA1 25adece1379cf7dbd1104acb6a51721a4df5cd51
SHA512 b206a2ad5ae8831bd497c87d79c57eccc4bea363b0acf36b68563bfc8795039a361257f8afa8552f45f4c11d5da91229e02e4bf65a4df7886b2038b12b9672d5
TLSH
T1F421C4FE864C42EE66E5B0D254B0CAFD11E3C55404123551ABAD7852BF9DCC5A06D1EC
MD5 SHA1 SHA512 TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Roaming\TeraCopy\Options.ini
Size 1KB
SHA256 c17fbc76f74dbe2ebb0d5ed4c9c5e4027a96f3fc1da94f04f652447a8c0679a6
MD5 17d717e3feccc857c2bbd7407c25bc1d
SHA1 ae8a2aaaa32218577a061b0b54d85fab7ecc0581
SHA512 999471abc71d38941e5273097ef9089ece1a653099a08d76f4641fe3cc7cb8e22d18fcb137c822137ce2da2b43c57df951f9e0b158e73051d0bd9fd69cbff1ef
TLSH
T1A021C4FE864C42EE66E5B0D254B0CAFD11E3C55404123551ABAD7852BF9DCC5A06D1EC
MD5 SHA1 SHA512 TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Roaming\TeraCopy\Options.ini
Size 1KB
SHA256 49b343007c88800c080612acebf579ff271006527ce8da7ccbdab36de14ea609
MD5 bc3a50319373f1d9239df76889b9f177
SHA1 57f90e564b8f7131627730932cc6b8ea3e356dc9
SHA512 5e9e242a54b90912e6be557b5fa348deaf8320d4ed2e92723fec203995676fbfc57ce2ed9ec3dab8dbd6bea05bf69451e9314a0d9201d62a5df7348f77c96ba9
TLSH
T14921C4FE864C42EE66E5B0D254B0CAFD11E3C55404123551ABAD7852BF9DCC5A06D1FC
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2076-493-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-254-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-250-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-253-0x0000000000F5A000-0x0000000000F8F000-memory.dmp

Download

memory/2076-252-0x0000028C1BC10000-0x0000028C1BD43000-memory.dmp

Download

memory/2076-855-0x000000005B9A0000-0x000000005B9F5000-memory.dmp

Download

memory/2076-786-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-255-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-256-0x0000028C1BC10000-0x0000028C1BD43000-memory.dmp

Download

memory/2076-495-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-251-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-248-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-265-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-424-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-425-0x0000028C1BC10000-0x0000028C1BD43000-memory.dmp

Download

memory/2076-273-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-491-0x0000000000F5A000-0x0000000000F8F000-memory.dmp

Download

memory/2076-276-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-494-0x0000000000630000-0x0000000000F8F000-memory.dmp

Download

memory/2076-496-0x000000005B9A0000-0x000000005B9F5000-memory.dmp

Download

memory/4500-364-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/4500-377-0x0000000007580000-0x000000000758A000-memory.dmp

Download

memory/4500-360-0x0000000004F90000-0x0000000004FC6000-memory.dmp

Download

memory/4500-372-0x0000000006370000-0x000000000638E000-memory.dmp

Download

memory/4500-361-0x00000000056A0000-0x0000000005CEA000-memory.dmp

Download

memory/4500-362-0x00000000055A0000-0x00000000055C2000-memory.dmp

Download

memory/4500-371-0x0000000005EF0000-0x000000000624B000-memory.dmp

Download

memory/4500-373-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/4500-378-0x00000000075B0000-0x00000000075B8000-memory.dmp

Download

memory/4500-363-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/4500-375-0x00000000068E0000-0x00000000068FA000-memory.dmp

Download

memory/4500-374-0x0000000007CC0000-0x000000000833C000-memory.dmp

Download

memory/6700-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/6700-423-0x0000000010000000-0x0000000010030000-memory.dmp

Download