Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe
- Size 22.4MB
- Sample260710-gvylyaft41
- SHA256 4bd1d4b8bee8ac9f21fbf4947d1943ed19872e7765a5b16860a289f74ecb2435
- MD5 212785a4d1eca7a9227cfd0a96f14dd6
- SHA1 01feaebb7d7efe43f76b5445005a2bbe8b104702
- SHA512 63def608fd96cb27ca704525a802ccbcdd497e71bebf71507a8b5b169d95cab897f5ef84d3aa34aa383b0f0e4d300cb435c5f0cada253597e5f7bd2c064807b6
- SSDEEP 393216:08FEEOqY26QpwMSPQ17xMJfq9ek282OPh7DVxs/HaezaCegqqocVcp:EEO326QmMSo17xMg4VGPL8JzCgqL
- TLSH T143373321B04001D8E16E44BADAF87C5FC5BD7E0B91D1C5AE269877113CF8FC99E42AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion TabReports.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion TabCareCenter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ActionCenter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SSDOptimizer.exe - Executes dropped EXE 5 IoCs
pid Process 6124 Integrator.exe 4372 SSDOptimizer.exe 3864 TabReports.exe 5212 TabCareCenter.exe 3220 ActionCenter.exe - Loads dropped DLL 64 IoCs
pid Process 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: SSDOptimizer.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 SSDOptimizer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Integrator.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TabReports.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TabCareCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ActionCenter.exe - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004\ SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 SSDOptimizer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 SSDOptimizer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ SSDOptimizer.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C47287F4-E7CC-00D2-BA95-0974B367E407} Integrator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C47287F4-E7CC-00D2-BA95-0974B367E407}\Version\Assembly = da941f9ad017e0267c0cf109f78b6900da941f9ad017e0267c0cf109f78b690088ad8cbb5ed3f66b83a8a2cdf194269c890bb34aebd806e41a50d3bd9c0b4765219909f09e75dec0927ff4e8152284cd219909f09e75dec0927ff4e8152284cd59b5414605bae21e9735786eb516d3f8de1283c2aff9bf99d33ed2740c86bbd2f8157495fe950fa4a01046bb55f00dad0f20aa1b1adfe602954529934d03147d Integrator.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C47287F4-E7CC-00D2-BA95-0974B367E407}\Version\Assembly = da941f9ad017e0267c0cf109f78b6900da941f9ad017e0267c0cf109f78b690088ad8cbb5ed3f66b83a8a2cdf194269c890bb34aebd806e41a50d3bd9c0b4765219909f09e75dec0927ff4e8152284cd219909f09e75dec0927ff4e8152284cd59b5414605bae21e9735786eb516d3f8dd50f5c9c2a951f0edaadc43e39635398b2c674389da98eec01c7b757edff1b05af796c49c829b7759422bc735dbcfe8c9802c09f525d7e0e96a5e61d98c19dfa3b0d389305332fc9d2bd0537cdfddd9022a4c47ef802e5065fea693f620ccc204 Integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C47287F4-E7CC-00D2-BA95-0974B367E407}\Version Integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node Integrator.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID Integrator.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E SSDOptimizer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd SSDOptimizer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd SSDOptimizer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6124 Integrator.exe 6124 Integrator.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 3864 TabReports.exe 3864 TabReports.exe 5212 TabCareCenter.exe 5212 TabCareCenter.exe 3220 ActionCenter.exe 3220 ActionCenter.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 3864 TabReports.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe 4372 SSDOptimizer.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 3864 TabReports.exe Token: SeShutdownPrivilege 4372 SSDOptimizer.exe Token: SeCreatePagefilePrivilege 4372 SSDOptimizer.exe Token: SeShutdownPrivilege 4372 SSDOptimizer.exe Token: SeCreatePagefilePrivilege 4372 SSDOptimizer.exe Token: SeShutdownPrivilege 4372 SSDOptimizer.exe Token: SeCreatePagefilePrivilege 4372 SSDOptimizer.exe Token: SeShutdownPrivilege 4372 SSDOptimizer.exe Token: SeCreatePagefilePrivilege 4372 SSDOptimizer.exe Token: SeBackupPrivilege 4372 SSDOptimizer.exe Token: SeSecurityPrivilege 4372 SSDOptimizer.exe Token: SeTakeOwnershipPrivilege 4372 SSDOptimizer.exe Token: SeBackupPrivilege 4372 SSDOptimizer.exe Token: SeSecurityPrivilege 4372 SSDOptimizer.exe Token: SeTakeOwnershipPrivilege 4372 SSDOptimizer.exe - Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe - Suspicious use of SendNotifyMessage 36 IoCs
pid Process 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe 6124 Integrator.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4636 wrote to memory of 6124 4636 2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe 86 PID 6124 wrote to memory of 4372 6124 Integrator.exe 87 PID 6124 wrote to memory of 3864 6124 Integrator.exe 88 PID 6124 wrote to memory of 5212 6124 Integrator.exe 89 PID 6124 wrote to memory of 3220 6124 Integrator.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_212785a4d1eca7a9227cfd0a96f14dd6_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Integrator.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Integrator.exe" /portable2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\SSDOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\SSDOptimizer.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TabReports.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TabReports.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TabCareCenter.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TabCareCenter.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5212
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\ActionCenter.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\ActionCenter.exe" /portable3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 f867134d922cc7ad30697f7ffd23d42b1b7cdf843e841678ae48d5c6534a54a0
- MD5 71c3eddf6a087124dbbc99c1429e2324
- SHA1 51aa31c49100043e67aefc4dbcca306a7e507268
- SHA512 0a45e4e2e3e58af3da48d1133094cfa6e7d2955fef9ec52378ecd699cd263154da35f5a1720600af0940ab8e42cc1b13c04fc507909ab33d7e7bb4cc27ae1ac4
- TLSH T134F0D4734453E137340694BC09F75C5D3465854E05DBC3332938C9C18397692E14B01D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 2a309b134ee2630cd8ac742660570286e0d0349d0181a317abf45a9de8058daf
- MD5 a08465841ec1d6c19e42047a465f5662
- SHA1 23f3158999b01aa2249470b13b71a4c7e58a098e
- SHA512 583c0911d7bd74fe1f9e40d380a5e3528c21b70a7b6ce36e09b2742fc6c4b349417df9801f8add80bc7fc7afc072520103b57eb17be93c1df7d6924d56fb49bd
- TLSH T1F501654338584A44F701C4C3979C9175F4279A8114BB1E0C32982A4889C65E54713593
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 5a0a04ac3501083de9b75e1858488504ec72be1d0fff514a639b59268f8458b6
- MD5 f9bdf4d4adc924557d8fb7180ab098f0
- SHA1 a291960b5bad1c2a3b1a15258b2e5cf0cf2b7293
- SHA512 ea161b16ccf93df99f447fb06a7919ab9e336823693454076dc0757bb4e6663d2f41309c8d1a22eba82f05513f332fab61dca05ca28e417efeb4d29dd88b7bca
- TLSH T193E0C03023FF101EF1A08B3843D5D0866F25F0072C0552FD0E81586C9D0AD004D66C31
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_87F41CFEF38E09B17501EF522EACDF50
- Size 412B
- SHA256 f42953ec797d95fdccc638c910c8ed5f380361f070775909a421ef3a73dc848c
- MD5 69c0035d02699789281a43e7938dfe37
- SHA1 ced4c1cb37605351db2b906f0c89798f84b49cd4
- SHA512 c4540b47f84177319a10d23403194240776fcf772ed150eb2597105ab4f6f5380936a411274cc0b2f2858ebf64b42b629f4ba4f18bfbb75f1f26654ee5111e20
- TLSH T1F5E0C03831F9094DF0B4D03443F954F56959F20B1440C67D15806B057E38B401CD6A78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 7f1d04bc2a5fad89a6d2f9f5f20060651f20faa4da20b3498d381d7145e1063f
- MD5 457b5054c761412f73c3f8242308e4ae
- SHA1 cb8a9f6074e26f7287bcbda50822e102024a953a
- SHA512 38554ffb0899861d42c8504f9f3ab5fc94917a97c4bad984646cf5c13ef8076f0fe39335d4228c681434da857ac7ea555de60f93ff67810740eb22eb78073b7d
- TLSH T164E0683837EF795EF050CA3042E6E2764D48F255104493B907914309BB2AE045E12EB4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\ActionCenterHelper.dll
- Size 2.1MB
- SHA256 666330e13e90c142b9aca4113693fa102d30dfe755ae27b3e3d6a5301879af00
- MD5 f9096b5f72989a59cbe7deba9106d56f
- SHA1 52c7deb75d984c7c1f6f49aa463ace12c542c1fd
- SHA512 76f3ac6d6fcb65834f5bd4b745be80311d5eee8f13ca19b0a240ad303d6b893ebaf9e8d9d8414101835b71f1735889e4e04cbaed4858c111eb091d892ef4be19
- SSDEEP 49152:56b7Ejy5jZsv01STNpWs4SmsrjLuaW7W33PY:M7EAeWkr5W7w3PY
- TLSH T1A6A5E12273C9513AC0AF053B5DBFE890D97A39326522EC5727E61B9CCD7A480273B15B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\AxComponentsRTL.bpl
- Size 2.7MB
- SHA256 59ffade076fd0b0b12f4b1d48f0912d28405f3d6184367f8cd717d284aed4dbf
- MD5 97e74c65453e7e1d07bc6fc7fb015dd0
- SHA1 c2859ada1906ca3af3e66a1a42a47cab2b017870
- SHA512 050690ae699c2d5575f51710d2ff16a7b79ceb1584fea736f8194b2037f3a8e1d3614d3b3aea7158bb8bd8375c6298ec49b3c8e381ede28df8e195ad54853b67
- SSDEEP 24576:HfMrydiowZRuHmBDiIeHm3TZd944msOEbZWBNu8kPmbcObDDivcsjdyWaGxQD4:EsjHqZ39d9443bsn5kPmPXivNjAkxQM
- TLSH T1C7D53A31E25FE72AD1DF023D95A6E865DB7D1A11C023C856AAE18ECADD56880333D31F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\AxComponentsVCL.bpl
- Size 8.9MB
- SHA256 303d2c73c0a7c51ae6f0f5a09af14af8a26e2109b2c8063289822acfe5ec50e2
- MD5 2a0eb4f4cf05b3f63be9b8c6c6eb757e
- SHA1 d97d4513226d9319893cfdb45f3d4c726ccc9f9b
- SHA512 aa9af76061bc381747aef9ba892f89e81d912e0953496ca849ade362cd1f074b64159e9e7551452c82c67df8daa7d876e03887d93b41212437b59aa22a4e47a4
- SSDEEP 196608:oGhsgc0zj+XYNO1VmY29CfvLZlNYNDFFhAL:oEY9kCfVlNYR3hg
- TLSH T1AD968E31B3669779D6CB153F3DA9DA62893F6510A331B60B65E358A9CC83060737F30A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\CFAHelper.dll
- Size 97KB
- SHA256 918bd6dc0cb50c9d8d1cbeec38e7b7e0f1447af5ab14ef86284ba1e8f14ebeb3
- MD5 00ba25b811fe94db2091aa0d044b8151
- SHA1 79212e0156e50f2fa189cef18df4f6ca8e156edb
- SHA512 2e944cab13e1a49b609e9ef80f50654d51bd4b95beed8d699912be7becf4951b53859c80ea58eeea5f841e6686ad00990cddfd7ced8c919c63715f4699bb4f10
- SSDEEP 1536:/u3Na6z5PVSr7BesdVdCfgDoqYa/jqY/rMG7nj7fI:CNrYrlesdVlsqYa/j7/rMGDjLI
- TLSH T184A35C3392848875C862DC7178ACE850ABB7FC211814D59332DDBDDABAB1391772D72E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\CommonForms.Routine.dll
- Size 1.0MB
- SHA256 7a9ef43a49552bfa9b974feb6c57944486c28073c5ef16bec8aecfc860ee8dc7
- MD5 3c570e3f1c52c57af7c3db4c45a9debc
- SHA1 b80bd8f36764ab52003dbfb4d0cd6d228a59eb97
- SHA512 d47b91f69a8315c09156ba20442fa1928e56262a5ae8fd7cc9e58a8ae816bfb427f7043ab346afef79d10e14ac0e0ba992836cad0c83e30e1dd95b51987159d8
- SSDEEP 24576:UKE3OVTNIfZQ6X2ctZ/PvVbQaU7Sa90twE3gNptrBy8tPr:tE3OZNIfZQ6X2ctZ/HdKSa9/drBy2Pr
- TLSH T18935BF23B3994235C097043F7E6EEC50D87A66626131AC6B37E619EC99F5384273B31B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\CommonForms.Site.dll
- Size 345KB
- SHA256 8b6a1997b1422c9bf049074c593d60d4ddf28fa216faad22868767e5872b7cc7
- MD5 90f2fdb86c5da6fe5e034bd49f2783b0
- SHA1 e987eae95f6391c7d6e5aee6e5bae10fa0e2faba
- SHA512 daead7c53c82845fcdf8b054063a4ce3a2b85f3e901d12ec4cd2bb728a021bd092951f6c2b10a505429aa785c252d2b2e2890bc19d6802e822b1e7706c68248b
- SSDEEP 6144:E2WC7pCwrXZxFvRPeY8Vriu3R3UTztAaE9+nvN1lqJ7c2MOW96+B:BWC7p7XZxRRPeYju3R3cztAaE9ArYt1i
- TLSH T1C4749F35A1889436C097153569AAE8B0F93F6E325715C85F37E82A58DABE091373F30F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Data\main.ini
- Size 920B
- SHA256 8debe271944abca5afbb33138d63aec3fd35cbecbbc62241dcf12b8f602bb87b
- MD5 0d1ee53c641df8db712b73754707b91f
- SHA1 09cf6fe0871a8eb78a24a9641646ebd150fbc0ae
- SHA512 f0ea784a07d9b113658f0d7602aff30385acd0aadd1c5450f83029f2ff39ce67c089b87e8145bdd9071a3c65bddc34e1c853801c8f8d3bcd58b7dc3ada430402
- TLSH T100116861FB82AAB845AF3670AD51B0C0A24300E186072627F3EE59DD43D658B437EBC6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\DebugHelper.dll
- Size 536KB
- SHA256 a0e175ea531a9a7532eefda834685862d5a1fce59497a008086f112590f00f0b
- MD5 e796cb2477b13214a5ca53acdbfcdcdb
- SHA1 5dd854e7f02d70f83d33eb381aeb773d2d4a9772
- SHA512 6b84356ba4779fb6b8344dda1aca1f1210cd2207bee02ec410ce97a63d6c136b5bdabd909279f202c63042d003fe028c8b3e48b503b0ecbc04d692a8d6888749
- SSDEEP 12288:+IXiLWmAxQK4K/rYqSXTonLKYfDTq1RPaNQfO:5GWmAxQHKDYBXT6pqzCiO
- TLSH T1BFC47C23E785C077C063053A6D7EED61C57AB9106531B98736EB2DACBBF4384272624B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\GoogleAnalyticsHelper.dll
- Size 141KB
- SHA256 7aa03fa27a50e36288a49f14c586d7ca1842c1cfce291a42a768de7a44f6dee8
- MD5 aa07215035709e78972e839f7020a32e
- SHA1 ad8f4e732d92d82bbbd11c7738d3a7a8eeffa233
- SHA512 04424d8730c375b91f7ab4f6f5a044b7984174f98300782c98f7145fe1e8e53668bef0c081fdf7f167485ca071fcffb2461f6086f5936245c5ca905936c6df28
- SSDEEP 3072:sUP847QuVp+3E5e27MLc2usARVhTzC8XtJ5UCP:zF7QuVpzeQqARVd+ctV
- TLSH T1D4E32C36F2C4E978D49F053578A6F850CE7BA6227511CC6773E84A89CBA9580277F20F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Integrator.exe
- Size 6.1MB
- SHA256 9e52882a3a2fc23c2f504310de85f4786306fb39980808b7b9c0607d835673f2
- MD5 4bf20cbfc07f03fbc252982b22088b7b
- SHA1 04dd73f38bceaccd8b361bdbfb6d1869221180e8
- SHA512 faea5628f1c3cd98c0ef68e4d27f1981e3dba77d4f571b6af49a9fc42b26566031c544ae29137c0f69b349e43ccf372f776bab2c27e56746792bd764576ae0c1
- SSDEEP 196608:qjrDhKr+oScGldwC+22Wbw+Dgi8p77Je054qHyXn2lL/Z:qjrm5bSQ/Z
- TLSH T1AB56E031B34850BED15F163BDD3AD845C83E3E112161D89B72E02B4C9DBA9857B372BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Lang\enu.lng
- Size 437KB
- SHA256 3299fedcc7212ef385ed707f5f1fffe85c40b4b82965a4861f342831b5436dc1
- MD5 ab89856d03f63c0f4798ad527fad7af0
- SHA1 6137da08ffebb9e4fe472c9cc08e40ac6d6dc78d
- SHA512 afb9f238c7a527bf5fccbfa74fd626b68d3d56295b955a86c105db38154290e1a51d122d6a4497ee2f994251784ab7032106e47b6361b5179c3c9095f1a9a44e
- SSDEEP 3072:DBndRwVt6iBAcVHa7tBDkwSFm+jLnYZbMl7B+65VO7y4spVM6Gt90EXRbVPhSYnj:DzXtFmYVyVO7y4ojRnaz
- TLSH T1B694CB4163FD5118F2F77EB56FB982988A3ABDE6AD76C21E1110101F09B2E41CA72737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\Localizer.dll
- Size 192KB
- SHA256 a2f8b562a735138c13b9e2b33c9637561ed31b3d9911bb765af822408a9be69a
- MD5 fffcf0b70ac6b78d631252274f2b336a
- SHA1 42f33ab739a25f2e54e628e55d468fbcb47c304a
- SHA512 3ca66071fab79d8a46e57b2c55dd34b460fa034472f22ed5fb07ba22c6ba9e0ee787b83a3b41c064cbf89772c0b614eb7c2ea659669cfd00d3311c6000c6862e
- SSDEEP 3072:IGuSpUfzX3Zfz26FCM6tpujFVUenRVsyEwWsqYaBhj7/d+uU06:8hVAwVjnRVMCaBhwRB
- TLSH T1B0145B22F244987AD56F00356C7DE980C97BAD716A11D99333EE7E49EAB5180273E30F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\SSDOptimizer.exe
- Size 3.1MB
- SHA256 05b1e51f152e1f4cf108a6e69fec2e9cb3bd15ac045af282993a9d9e74a94137
- MD5 4572c49f0db4019e66c4caa2d3cb8e6a
- SHA1 730f46a03b5f4e067000e21e1e358aada75e16af
- SHA512 8ac6d75e263b6338d1d66ce51e1746a24b7dd8c0c8a1a5ca4766c83c0ed866d0594b7579c101cb4ccc69dcaaec3b4b697c26b3b04dce3a198d98153d8edbc7a7
- SSDEEP 98304:hu+xSVaqwaVRmw/vvKSPxJ+oScGldwC+22Wbw+VNgi8EIEPi:Q+fgRmwiSP/+oScGldwC+22Wbw+Dgi8R
- TLSH T132E59F22B348407EE06F193BDD7ED845C83E39112662D89B37E41B4C5D7A9817B372AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\StyleManagerHelper.dll
- Size 3.0MB
- SHA256 8d76cbd70587f0992d4f5bf40be6ebc7c7f8413dd3446de8cf497ca8408867a5
- MD5 28b6043483888d986952a37fb1bcfdbf
- SHA1 9704839174da13e12105cf7b53a76ef035a32ac6
- SHA512 780e08802569355497e8a787eec9df17f003836b533ff687e3f847f0426b7ac4dfc672a5db45f96883b69256e76a479661aa2f0f34a84afe9221ebe4adde4e68
- SSDEEP 49152:V5IkSMWLzGAU6yScoxJfJbfpz4o+bGFYBV0xkkH/lHsWdoDufib0o:jQzGAU6nTxJhbRszbGqzkflMnufib0o
- TLSH T146E5010077EA8658F6771B376EBBC4D4C53ABD70FE21D69A3A14064E8976E408660F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TabReports.exe
- Size 1.4MB
- SHA256 2291ad1324b36340583b45e3969c5e4c45ae3d10a0fd2cbaf5df2bf0b9a7f603
- MD5 aa66d31e4aec1496a1ae2b019618b68d
- SHA1 1dfc930a7fbbb5841e731f95cdc8ee74b7906e36
- SHA512 55216fced7f698b37b4ffb1740e91eb84b53a0c9ea47331bbc9e29e93f53ca7c0e9e0bc28edf063efaf670338f2ccaef775f062b914e5d41c4a757a0a250080c
- SSDEEP 24576:wJdWMrKjx/JLgpn3bHDl/3K6RPLJRN+E38wdvNkJP7:wtKdBLgn3bHZ/hJRQQ8waP7
- TLSH T13D659E226348847BD1E21A3B4C7EC580643A7E3D6A31EC5B3AD93B5C8F756803F66257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\TaskSchedulerHelper.dll
- Size 549KB
- SHA256 faff5cf69d8748ab256678376f87d4dd1c2414232116d5da254d7ac715720b00
- MD5 266a7c06ab56309fca7faf796c315e64
- SHA1 631f895c42d06158b06e30cdcf5ad040487c1fc3
- SHA512 567bcf0800dfcfa76b700b4f6cb919de0db2797c45d1b35471474831156db243cab4acbdb60bc1829b04f610dc5b2ad7c35de8267e06f2e1fd0135ab3cb40b64
- SSDEEP 6144:mSQBpv8QswoqGuPt5aN4keMxRWseFNrNvq154LhPJxPcNqxwL1ZafvaGtU:mSUp5Pt84k6xF5NBLPkZZivaGtU
- TLSH T199C45C33A2D0D536D4A74A3D89BBF16CA53B7E216A19CC477AE48C486D36540373B38B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\rtl250.bpl
- Size 10.1MB
- SHA256 66f2f6b2e8c24827d63f6415094ae40fddd50f30e097cda395cc0116d57356a6
- MD5 942cc74b7ef66b51859d135fa3bc8bb2
- SHA1 642810b822d9e4ddd40faafb7437b552d2ad7d56
- SHA512 941e41ed4031674168d4b4380d52cdea4d3077c1e871a9f61d8c85030befda654b06cb5da666d906130fa2d5b985573b274f9d77ac570b634be295baefa385e5
- SSDEEP 98304:zrPcd7oJhMeF+JH4m3r3PtjvcHZKbcX/d+XuJSLuV:zQ1ZJYe3P9c9PzW0
- TLSH T112B64B31B328E531D0CF163D5DA6E4A9DA392A954972E006B6F04ABDDDA2480737F31F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\vcl250.bpl
- Size 3.9MB
- SHA256 10b9d8569b8f9e9e46e7a579855492353c43f1e3b5d4a28959015bed5570350c
- MD5 e4f482e3f7eb949256402c38e467122f
- SHA1 2910db3ffc1769d2ae83b6569fa91e79faaa4033
- SHA512 8dc4eadc0ebe0cc86e7ac85843c16be5cc563a5dce2985f34b4769786e5d2f7176b62506854ef5e5b75a58aa1cbe45934650e7cab098a639bc62affe9119241b
- SSDEEP 49152:c3WQ4ED/9aSr4TUpgZmhXQIP2mrzwFrAj7Bo0kL3udI+WN:cGQkTofzuAj7BhAt
- TLSH T117168D71732C967AD09B153D246FAD34E63AD7214221AB46E6F04DDC8FA14C63B3D22B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1223B69\vclimg250.bpl
- Size 355KB
- SHA256 6be794294ff9c4b27debc6ed50fce865d028cf496d4e39fcce9c4f8e48cbfbfd
- MD5 57496780b9a5c733144e5663f088f42a
- SHA1 ccdd74d1a638629f8fdba43ce1180a23d7a463dc
- SHA512 50cf52cc8524551e9fd106c823039f604df2b92d2de859ef2d4b85016d603a6c31dc928e155949554c20ebd63f5b5665b627cc8853576a6149f2213b533f16d0
- SSDEEP 6144:FdJVpo6Pb6So4ZmCY6wAnAGgDPFLYU1hHXRn5c1zOVFvdcy3O:FNpNhmN6dAGgDtz1hHXx8zuvdcy+
- TLSH T194745B91F3552437DB03073AA86EEE64C93FA7212513EA6E0BE40C85CE566C72B5E317
- MD5 SHA1 SHA512 SSDEEP TLSH