floxif | aef14df59624d90af0e3a12cb00125f08dfa0cf943cf2d2422e7419f900cfa4a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
Size 644KB
Sample260808-vxm5wa1fld
SHA256 aef14df59624d90af0e3a12cb00125f08dfa0cf943cf2d2422e7419f900cfa4a
MD5 b9011b7ffcd33ccd7f70e0b49d3c81df
SHA1 19d5d4e32b3eb066cbe37253d808810e1acb22c3
SHA512 48e749f216bbe260e1f42e23fdd632b5b5f525e60d35bc1e9fd2903b1d6b40db165561e52a30550a69ffae442ec9f90772f7a0058322519505a4169817f0bd7a
SSDEEP 12288:lKTSss8RFg6s6rvFqkZtrZuJySNprh+0VFYvRi94ZUsd/XXcZ1uWgOot6NkhlVBW:lKWs26s67QylZuJy6RfYpg4SsdvsjuWP
TLSH
T1B0E412127AE0C7FED1E021757188377965E2EA3C032A94C3F75405466F7DA83FA6A21B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution floxif persistence privilege_escalation trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000e00000001b1d0-1.dat	floxif

UPX dump on OEP (original entry point) 14 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001b1d0-1.dat	UPX
behavioral2/memory/4456-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4440-53-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5068-56-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/428-58-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/428-60-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5068-86-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4440-87-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5116-89-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3936-92-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/2604-100-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/2604-102-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5116-110-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4456-112-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001b1d0-1.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
3936	ConsExt.exe
1248	bschk.exe
2604	sc.exe
1212	bschk.exe
1696	be.exe

Loads dropped DLL 7 IoCs

pid	Process
4456	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
4440	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
5068	cmd.exe
428	mode.com
5116	cmd.exe
3936	ConsExt.exe
2604	sc.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	sc.exe
File opened (read-only)	\??\F:	sc.exe
File opened (read-only)	\??\D:	sc.exe
File opened (read-only)	\??\d:	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001b1d0-1.dat	upx
behavioral2/memory/4456-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4440-53-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5068-56-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/428-58-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/428-60-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5068-86-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4440-87-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5116-89-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3936-92-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2604-100-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/2604-102-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5116-110-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4456-112-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2604	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe
5116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bschk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ConsExt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bschk.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3900	reg.exe
4920	reg.exe
4556	reg.exe
2700	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4456	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
4456	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
Token: SeDebugPrivilege	4440	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
Token: SeDebugPrivilege	5068	cmd.exe
Token: SeDebugPrivilege	428	mode.com
Token: SeDebugPrivilege	5116	cmd.exe
Token: SeRestorePrivilege	3692	reg.exe
Token: SeRestorePrivilege	4528	reg.exe
Token: SeRestorePrivilege	1252	reg.exe
Token: SeRestorePrivilege	6024	reg.exe
Token: SeDebugPrivilege	2604	sc.exe
Token: SeRestorePrivilege	1696	be.exe
Token: SeBackupPrivilege	1696	be.exe
Token: SeRestorePrivilege	1696	be.exe
Token: SeRestorePrivilege	1696	be.exe
Token: SeRestorePrivilege	1696	be.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4440	4456	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe	89
PID 4440 wrote to memory of 5068	4440	2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe	90
PID 5068 wrote to memory of 428	5068	cmd.exe	92
PID 5068 wrote to memory of 4092	5068	cmd.exe	93
PID 5068 wrote to memory of 3176	5068	cmd.exe	94
PID 5068 wrote to memory of 3900	5068	cmd.exe	95
PID 5068 wrote to memory of 4920	5068	cmd.exe	96
PID 5068 wrote to memory of 4556	5068	cmd.exe	97
PID 5068 wrote to memory of 2700	5068	cmd.exe	98
PID 5068 wrote to memory of 5116	5068	cmd.exe	99
PID 5116 wrote to memory of 3800	5116	cmd.exe	101
PID 5116 wrote to memory of 3936	5116	cmd.exe	102
PID 5116 wrote to memory of 3692	5116	cmd.exe	103
PID 5116 wrote to memory of 4528	5116	cmd.exe	104
PID 5116 wrote to memory of 1252	5116	cmd.exe	105
PID 5116 wrote to memory of 6024	5116	cmd.exe	106
PID 5116 wrote to memory of 5904	5116	cmd.exe	107
PID 5116 wrote to memory of 2632	5116	cmd.exe	108
PID 5116 wrote to memory of 1248	5116	cmd.exe	109
PID 5116 wrote to memory of 968	5116	cmd.exe	110
PID 5116 wrote to memory of 5492	5116	cmd.exe	111
PID 5116 wrote to memory of 2604	5116	cmd.exe	112
PID 5116 wrote to memory of 2988	5116	cmd.exe	113
PID 5116 wrote to memory of 1748	5116	cmd.exe	114
PID 5116 wrote to memory of 5836	5116	cmd.exe	115
PID 5116 wrote to memory of 2148	5116	cmd.exe	116
PID 5116 wrote to memory of 2888	5116	cmd.exe	117
PID 5116 wrote to memory of 4468	5116	cmd.exe	118
PID 5116 wrote to memory of 5908	5116	cmd.exe	119
PID 5116 wrote to memory of 1212	5116	cmd.exe	120
PID 5116 wrote to memory of 5932	5116	cmd.exe	121
PID 5116 wrote to memory of 956	5116	cmd.exe	122
PID 5116 wrote to memory of 1696	5116	cmd.exe	123
PID 5116 wrote to memory of 1496	5116	cmd.exe	124

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1496	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b9011b7ffcd33ccd7f70e0b49d3c81df_elex_floxif_wannacry.exe" -sfxwaitall:0 "main.cmd"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\main.cmd" "
    3⤵
    - Loads dropped DLL
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\SysWOW64\mode.com
      mode con cols=80 lines=25
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir ..\NTaufix/ad 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Windows\SysWOW64\find.exe
      find /i "NTaufix"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3176
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKCU\Console\%SystemRoot%_system32_cmd.exe /v QuickEdit
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3900
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKCU\Console /v QuickEdit
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4920
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Console\%SystemRoot%_system32_cmd.exe /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4556
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Console\%SystemRoot%_system32_cmd.exe /v QuickEdit /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2700
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c NTBOOTautofix.cmd
      4⤵
      Loads dropped DLL
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\system32\mode.com
        
        mode con cols=80 lines=25
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\NTaufix\ConsExt.exe
        
        ConsExt /crv 0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Windows\system32\reg.exe
        
        reg unload HKLM\BCD00000000
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
    - - C:\Windows\system32\reg.exe
        
        reg unload HKLM\BCD00000001
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
    - - C:\Windows\system32\reg.exe
        
        reg unload HKLM\BCD00000002
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1252
    - - C:\Windows\system32\reg.exe
        
        reg unload HKLM\BCD00000003
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6024
    - - C:\Windows\system32\reg.exe
        
        REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate
        5⤵
        
        PID:5904
    - - C:\Windows\system32\find.exe
        
        find /i "InstallDate"
        5⤵
        
        PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\NTaufix\bschk.exe
        
        bschk /nt60 sys
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1248
    - - C:\Windows\system32\find.exe
        
        find "\\" autofixx.tmp
        5⤵
        
        PID:968
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\NTaufix\sc.exe
        
        sc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Launches sc.exe
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - C:\Windows\system32\find.exe
        
        find "6."
        5⤵
        
        PID:1748
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ver"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5836
    - - C:\Windows\system32\find.exe
        
        find "5."
        5⤵
        
        PID:2148
    - - C:\Windows\system32\reg.exe
        
        REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        5⤵
        
        PID:2888
    - - C:\Windows\system32\find.exe
        
        find /i "ProductName"
        5⤵
        
        PID:4468
    - - C:\Windows\system32\chcp.com
        
        chcp 936
        5⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\NTaufix\bschk.exe
        
        bschk /nt60 sys
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1212
    - - C:\Windows\system32\find.exe
        
        find "\\"
        5⤵
        
        PID:5932
    - - C:\Windows\system32\find.exe
        
        find ":"
        5⤵
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\NTaufix\be.exe
        
        be /export D:\boot\BCD1
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -h -s D:\boot\BCD1.*
        5⤵
        Views/modifies file attributes
        
        PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BOOTFONT.BIN

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BOOTFONT.BIN
Size 639KB
SHA256 a51f2722dee9d025d9374adde64cb4c4bcff7fa6476700e3a5dc2f868be37031
MD5 4d02ed132e280ff800843ebe1823938a
SHA1 4623336a7094bdb9fd626a7c82a97d811eb7a530
SHA512 97ea188d391f8947bbd15c1315d547e3712496646a03f7119ca9b5695a575802dd5b630190961dd073d75e41cfbf6f3cb6022e5bf0435cdbe0495a75c5bf05ae
SSDEEP 6144:W0PLtVp1FcNqFl3zk20OpHJpP6EEqD41lIsibKzTsmV1zcq7fiiUpMO98beTSkbN:S5R7aP9HbESer2qsdHbJCo
TLSH
T1DBD4D6721251B427DC7DA3376AD30E10A8481EE0019164A384BEC76E47F9FA55BB7CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConsExt.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ConsExt.exe
Size 196KB
SHA256 4a26dc01b9297a14cc193d8412dc26404272c4953749ebe4543eb4112cc37b67
MD5 71ae72fb2cee3fdac2ece55a7290df07
SHA1 0cfff4ff2f87eec042243a5bfd0dcd39293c740d
SHA512 d0443639b2ed9ff854b01b5cab375763826394b8fc48eaed578884d93172f507c2e531c394776968f991dca94b00c4dda891fe8da9c27db659c621796712cefa
SSDEEP 3072:xMbNhELhVqvwcpXCxSLo5tQ5ty5tS5tEKBMNod:xONSLnq4cpXCsLMKB7
TLSH
T1BF145B35E552C035EAE3C0FAC7E687B9B6385A31534010D3D3C8AEF96B295E96A3141F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTBOOTautofix.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NTBOOTautofix.cmd
Size 59KB
SHA256 74c9dcece037df74c9d1c541c717e1c20ef9eecf0d89ace2db9516ae6b00d451
MD5 b792893663a0b74525417948964b31a2
SHA1 7e01959c0ca89a4ab333df38497206165341a62c
SHA512 6a0a5736f64f039c0397831f6b1fa1214ddbdac397fe12627d31d20eaac9a2d388de9eee1a9d600ef4f7b949d7c6147aa3d83ff01172b895d06c85ab96892227
SSDEEP 1536:Ml5U287jGWXUtMnkf1t8+HNN5wCZn8uDAPSWWPi+Sv:Ml2287jGWE/f1t8+HNN78ukTWKz
TLSH
T10153531C3C49548304D6EB794AB94212F29AD3535220EACC35AF95B5B31E3E623FC6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTDETECT.COM

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NTDETECT.COM
Size 46KB
SHA256 17ed3744ff8cb847ef89d0e42111e6ba27bd688b160a594a3abef078e05c4868
MD5 cdce1413695a6ace7304e77f35aa3a37
SHA1 2759c5a8707c6c6ec5c1326364bd43b31159e3a1
SHA512 0562085ddf75c66687cf16b72be3751bd8032df1ebcd2640835ef84adb47e5471d9ddc32822d9c17e6674fd28c3d1966758f215d4423be12148553b29e6fba0c
SSDEEP 384:G9Qpxllvs4HNnxVVT4wRkXwxy0mVFuuMmYHIKCJ7nSxQwW6Q+baKjLp5SznRwSHP:V7lJd6FR5GbgohS9wqMOgKleH1BM2RLM
TLSH
T14323E8242549C2FCE3D6F0F489AFC4AEE42784A717101CE53BE904A98D46A5CF75BB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTLDR1

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NTLDR1
Size 253KB
SHA256 3e18835b433e11574289e90943cf32041d4cc93d02a3142e7ea8b0b0628745fc
MD5 0da9b3c93229ef59c45cfb3522b20f9d
SHA1 5ec34ca100d71127affcad3cfe8e5892eb22f964
SHA512 cd84c5760ed2f1a5d74cac97dd5919cf3c24e0cfe2661d12de192504c9f5765a4f54780b3f399845730395e066b444cd6d76eb4807162873224a9f8c7fe2d246
SSDEEP 6144:GAruzuGg2fWvILrp4mSeMDRX5xnraZmU3DG5gUBlQd52EJO1AJeG0EmpY:tN3Krp+NX5VraZmU3DG5gUBlQd52EJOF
TLSH
T14E44AE5273F15032C76132745EA7A37140BE66303A2325EBAB940DB59A68FC1672E37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTLDRC

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NTLDRC
Size 8KB
SHA256 53dc8fccfd10b727a5f720e25dfa7af196a96bfb03030ad718627fd880d2ea7e
MD5 a0412aa2ac70427ace8fef14fd8e9595
SHA1 b58d86977de48d40e797d47bfed8a8b72f234c21
SHA512 da19aa322a8491570d69908446a81f2ce4c51f97c6cb7394296fd2a3bcacbb5c8d26ba95d2ef35a27767cf884a653f37acc120eef74e8fc2a8ce989fa946adcd
SSDEEP 192:mb6qKRQjAaExgh5I2iRSTUkGFtCi5+MziLQxAS0DhMUlo:rqJcaVhFigTUfPCikMzAGYhMUlo
TLSH
T18102C757672E2555C1362333A77FC22EA8B7602E99771237014D4AF8F88081BA686F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTLDRE

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NTLDRE
Size 8KB
SHA256 1f112c7b2034e51368472cecce95f97528ded6a8490cda74b7ba68025f619018
MD5 f91820cc1954eada9aa1cbec011ee543
SHA1 6bda900935390028a0328223b85eeaba09a7c090
SHA512 c36534057d2678aae072077feef282d4b0516ba366d4dc0167ea6e0f6fc2c65abf47e57d9977f018f03881f73594eaa2922b328c30b48b047df6721612b1ae5e
SSDEEP 192:TCSJSPS4SfSXSkSRSKALwV7NAc+DS6V7Sxj+09d5txjxvX4H3IUWAl6k9Aq2AIJX:meojoQbOkwV7m5V7OjpDtxjx/4Hb9T2z
TLSH
T11012A72713050A26C6F30373ACAED352F67D02ED47678319209DE16CB24585BD72BDA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

attrib5.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\attrib5.exe
Size 12KB
SHA256 cba924415f9d08abe02724f07115a165698c55010540fb14f382949726aff68d
MD5 118176e996fa8d6d25694d4f6e713ace
SHA1 3f6005729b26b4767ffab9b2d14d91d329acb806
SHA512 bfbe69fd467f5b28e2f45724c8769def25b4f7267f0390f47c93a9eac434c3942b545e20f96d36d46b766e1c02e2bbc25af0cc6029740ad31657f4677d0a40c5
SSDEEP 192:M29ZgZNuzcPXWlI6wvCQQaLS4Twv6ujZ1nAgwc4A35gMnvmAIwW0FtW:M29swzcQI6IS4TwtiA35gqmyW0FtW
TLSH
T120422B32F549133FE9C111B0426E3A67912E2E209F7C47CF95AF68A63C243B54831AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bb.exe
Size 143KB
SHA256 bed30b55a157cdb87215b99cdf603c556f633a91467c6145ea40b62718ad83bb
MD5 8b4ec4915b016e65ebe76d91a0b43577
SHA1 1c38b8b400a6d9037b7b2b5b07d65b5f021dbfb2
SHA512 25b42e3e5bc0005b99ff96d289316caa3c828e1e4a7071f1ad560980d76cd72065e36f1d8df9173456d9f5750aa1e33d5704f8d6b5d64ea5d9c2c3109888ddc9
SSDEEP 3072:EgwNYLs1Y1Mz0nirjfbvUj+UNBCsGnC7TGhh+UNMAg8n4Mul:E1YLMUj+bRC3Ghh/gV1
TLSH
T1EFE3061222E1A138E0F7A9B0267D5B2047BBF9A01B35DBCF53440ACE6A75ED18B31757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\be.exe
Size 288KB
SHA256 28c47b5017260ec82ae70456455953f6deac2d6b6590cec206f9ab8c5d3fde50
MD5 3c2a9f3195cddd8943971dc8a677ef25
SHA1 fe65e384bef1a26e2968427c02d246fa87ff2b75
SHA512 0a5049b3ff5efa18e4eab9bd30537c531999aef7ce1b6a4967cd43d0124d781d2dd665f42fcce6ecad22f131571126bfca74bd0d55f8489ea043f01920afb879
SSDEEP 3072:7/lIyjVlXgty0/ISHUv5x7Y+4ctBI5IhwMNg4CKdTRhdNV/ysXo34D62xKe1P/ut:rVXmy0ATtC5IhfOt
TLSH
T13254FE0263E94205F0F73A745AB956708B7BBC91AD39D68E129D115E0FE3E808D71BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bs.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bs.exe
Size 95KB
SHA256 c8ff090cecda0c966a050f1c5b3f5b84c92d181ac48bf52402dc41ada65877cc
MD5 c86ef10e5f037a3d2e352a87aca3df98
SHA1 dd47a20474d07517b0f0da1a2aa2178a649b3c34
SHA512 eeae2d5105ac7159cba26b809e349300a74ceda602003ffd14c1ac4382eda892b3175949e1853eb88a94001ee4f22885390064c02e2375efaf01b96942c6b3a1
SSDEEP 1536:HYbtrIOZ5XZX+SQleQKdsN+jiRBlYvehtJVzR:qI85x5ueQKdsN+jiRIvezv9
TLSH
T1B293E81323F89124E0F239B45AB957714B7B78A06F34CBDE4284159E4AB6EC0DE74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bschk.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bschk.exe
Size 95KB
SHA256 5a33fd6b8471d94e01e29f6445eaf8b34ff24a5e5a1dea79aa810f3a6a291f9f
MD5 366c14b6d2ec6882699e939db081316e
SHA1 c1818d1c62646a026a576142796cc7b4ef29486b
SHA512 2ecfc75a75130d6993a50825f630c1afb59cb719c009c60e3b2387dcd34e6be041d42d675a3f8b7e4030f1ddedaa2c3b5d243e5ea03542733d43db6509c26a36
SSDEEP 1536:HYbLrIOZ5XZX+SQleQKdsN+jiRBlYvehtJVzR:wI85x5ueQKdsN+jiRIvezv9
TLSH
T1C393E81323F89124E0F239B45AB957714B7B78A06F34CBDE4284159E4AB6EC0DE74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsmbr.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bsmbr.exe
Size 95KB
SHA256 d298ed0554fdd176a839272637327e92395099cb962a12c5c48b586857d7893d
MD5 ba33b1f798be1af468918cda0a7d80ef
SHA1 ce988f2e3e9f9994ae33de0242f94f3329de2655
SHA512 0bf1cf37ef8a4504c48ecc1f6d61148e8535de7d774eaefdea09da630bac5ab5f5ca4393d6b6b3a3307653d1990682b72cb0089c8d70c6189b4784bd7b2cb514
SSDEEP 1536:HYbdrIOZ5XZX+SQleQKdsN+jiRBlYvehtJVzR:uI85x5ueQKdsN+jiRIvezv9
TLSH
T12F93E81323F89124E0F239B45AB957714B7B78A06F34CBDE4284159E4AB6EC0DE74B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chcp5.com

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\chcp5.com
Size 7KB
SHA256 23b5bc6d24b813f2c2f2720be6842dcefcc4edf8b170863bb4c6ea4df639fd94
MD5 d56e5ad02728dd5aad682838097f9108
SHA1 063897c70b3bda03ea9bebf0a8cc7e83ba0fb4db
SHA512 1f5365944f8748e9bc974c363855bad0251625f737d251983301681eb1eea5bcfedfcb28c5e57d3d996ef78d323f3cbda83294b0d0cc8383e006871de47b4fa4
SSDEEP 96:n2o5lhTVd2m9u5PJLh0ZMkRXG3Kq/sSFMEWkkwpUWw:n2o5lhpdu5RLh0ZMkpG3xs8WcUW
TLSH
T1E6F1F70266DA036EF5CA37784EB6639712B8FC558E3DD70F0247841A1E7552D4CB2BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chz_fix.bcd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\chz_fix.bcd
Size 1KB
SHA256 eeb8fb3583b58ed632886670fc8792f0209aed52d6aed9e6740073261fbc87c1
MD5 58c9f77d5d14ffaaead5d954dfd0a290
SHA1 44c084bcf954fd642fb9d5cd8bf0e65aeb325c67
SHA512 bd7195e43dea724beca169565ccfdcbb1c6d3c314b1ac0f9d06b834a45b1b130dde5758a0cb6979ea3f7d42eb505163651a3235512a86b4cead74f847b64d2a6
TLSH
T17E31544753F84968E0F61B3915BA4B162A73BC940AB8C11907D0A12CBCA5EA4EC70B77
MD5 SHA1 SHA512 TLSH

Submit Download

chzdp.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\chzdp.exe
Size 4KB
SHA256 4c53893202a51c14f040cdb70f86c522ecff3cf9718eed29576269e713581d4c
MD5 03bff0176873f2f014038692b4dbd438
SHA1 295ead1da24e40afca0a7b42ec1629ed6605800f
SHA512 fbea74e5a82532e0616aed2a203c8ca650e31d9f07f4430720db9a4a88d40d7eb088192c6d287b3a81c38344f72906cfaaf2ea839ecdbc8068f666e1ef5909ec
TLSH
T1D481532F6BE849B2DB82DE75111284CDED7695B013A081CF49977DACC4365539A3A20D
MD5 SHA1 SHA512 TLSH

Submit Download

find5.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\find5.exe
Size 9KB
SHA256 22d52947622cd4212066447c5a26ce348ae1b8fc56ba24e53199e1c7bc02bed0
MD5 0dc49311fc5e24a29662685efbe2f58c
SHA1 dfc643bff93f96ae7b8113bf5346e0cf9f7535a2
SHA512 788b8326f01c6c442d0d542189c7e0bc697518a0281a0e04f5e19cedb510a915bd26aae4a5474e4ad96b5ff883500cb6bb02e64a6479eb452b33d8d81f4aa877
SSDEEP 192:FpAi4coKZLHRkb6OWuFqPMk/3ElG4WXIW:FIcRbibLqt3E84WXIW
TLSH
T1E012E913A1D6072EF0C223B44A5B4786127BED46CE3CB38F47864A6A1D71B6E4931B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\main.cmd
Size 1KB
SHA256 71c922089127799fb41124c9c9b7801511b65cb2865bee3c0c32bebc3748d788
MD5 af0da4bef47bcd0ea9d81ece8487b1b5
SHA1 4e568f6bdb204e211e5be96e0fb94450c357df2e
SHA512 f30af1d7cbb2f314b1cdfa66e8f333b202486916b284c0b3cbcf627950e01307a131b7f9f17a428a6f064c8719ea62c775501a43f50f4dac1b21f47ce77127b6
TLSH
T10921324F9B0A0D5594C16634CAAE4143A4B6B4071A18FED56BF16CF9D00B76043F0EB9
MD5 SHA1 SHA512 TLSH

Submit Download

mv.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\mv.exe
Size 9KB
SHA256 0c607c353799084f75da13477be884f9781ebd3e15a28d57e6bbdef0d6ab6bc6
MD5 de27405a9e67dc17ab8bd255dbcccc6c
SHA1 269295e750781c3547ee944440f307de94e53f93
SHA512 d631b7e0f300ff5a0556a5024fdfb8d2e9ec211aa1c0200a10021c362003f24f63dab26944801448bb4ee1b3941fe18c63f9de503c51da1f4fbdd80e197ef16e
SSDEEP 192:ubDCmTHmDnYYu98tSMk10XP2gE3x1tsn/ZWKFWnWb3W0:ubDFTHinYh8tSv0XChjsnBWKFWnWb3W0
TLSH
T1D9120906A3F9152DF5E23A3009BA462A133B3CA5997ED74E46AC240E2FB39009D31767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntbootautofix.ico

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ntbootautofix.ico
Size 766B
SHA256 00dceba0d640ad7fa0330265633705d731788e519bb696a903f3ea7b4b35d2ed
MD5 62bf120ad41e02f4fbd6ab0d4ba081bd
SHA1 b2ceaa4cdf2fb0c03cbff78aa9dfeff78b64d3cd
SHA512 b44cd610b0d513f62b9d08da9fdd728f91058f3df32e703eab01df8d632ab2420d30c8a9adcaa13baf08226af035c468e86ff791b06fd2e6d48add5050d00fc5
TLSH
T1B0016DBD734674D6DA8808705D2F4BB80C721C20BF640056B1B6BD2F2E70A483B0D8D6
MD5 SHA1 SHA512 TLSH

Submit Download

reg5.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\reg5.exe
Size 63KB
SHA256 37ce5e1b08362ba9be71fac7aafadf7d687f85c309b9bd17987da1f5ff4f9475
MD5 322649497639c0836a304a57c5dfb781
SHA1 0783a95922874eb521d54a026e55b439fd6a9437
SHA512 93f7157e0367699e0191be88e9c4e9b9ecf6c52a7fc0df4f5ccafa10857f990a5b7c466e3a09c890e6c181b9b6e5c798de2809fbaeb29a66bf3efb219165b223
SSDEEP 768:0p++j7tX5TzprAaG9fvb4P91KGTAdgwrFmjXI/68Q:0tJJkVVj6mGT4g46I/68Q
TLSH
T14A53624323EA1014F5B73A755EBA817487BB78615E7EC28E209C625B4FE39409E303B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sc.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sc.exe
Size 4KB
SHA256 36caa213a29a70270a220e5c5f9a1471b1b3498dd31293260b521a23e7df1f2b
MD5 46829940f8992374e234d2ba4f96e0ed
SHA1 a6e7bfb1e838a2e3246e148fa2aeaaf0962e72eb
SHA512 caaa2b6ae26a5cc1c6906e17a6e616ecfba2545aaab442ef6d2064240a238257561c82ed4ca98efc5e5f0fe430773c0a690f80f9fe48c7d834ddea9f374d8ed2
TLSH
T13081E6274F490033EF5004B3015306B8B7BD6A36736885FF6F7721059E61E97790D2A1
MD5 SHA1 SHA512 TLSH

Submit Download

autofixx.tmp

Path C:\Users\Admin\AppData\Local\Temp\NTaufix\autofixx.tmp
Size 241B
SHA256 81043131a65a75c6191a58ca19701d884d78185e1b66feb64420323b932a3781
MD5 5450cab88c0954cc5be7179d8aaa31d2
SHA1 0ab87294b19067c62e6ce76f1b186218efbda4c3
SHA512 cde2a63f11d611b90e87badb35d4814ca5532e83e168f319caff894b67ab990660a9295291a97a47865590bc3cf1b51f2cf22326646307b17933db47f2461649
TLSH
T1AFD0A7205C55D0C0D3E280D2DAD0F554319E704A5BE55178D84D8FE8ED34D77968BC74
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-58-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/428-60-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2604-100-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/2604-102-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3936-92-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4440-87-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4440-53-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4456-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4456-112-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5068-86-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5068-56-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5116-89-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5116-110-0x0000000010000000-0x0000000010030000-memory.dmp

Download