floxif | 2b81a27691ff17584b0d6b122502aa6c4ecac568dfc3e8107e44c0833ec583b8

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe
Size 13.9MB
Sample261003-sshcqatsay
SHA256 2b81a27691ff17584b0d6b122502aa6c4ecac568dfc3e8107e44c0833ec583b8
MD5 2be72ff725b5802a455eaf5efc30b6e6
SHA1 094f3b808eb33274116ad949f59446217d55b710
SHA512 63a3b733091c39825361e15076295ea21d39ab0f1bd365a6643cc7c53dfb3168d82a09b06a23e563538eb1ff64eb9d5df54c3a927c68e5b46a09c9f64edf9b67
SSDEEP 196608:N1SN0c8tidKUmGdjyKP/iOvBa/ypX8y0tXBMe53vCCRXG1vWTRBkYQhTEC6W7x8H:N1liKULjy+jpMptRiuW1UJ2p7r9a4av
TLSH
T14AE633D2F1AE47F5E6839837204C3F4CE1B7DD5E82071ACB829655202E48BDECF99166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor bootkit defense_evasion discovery floxif persistence spyware trojan upx vmprotect

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000500000002325a-1.dat	floxif

Detects executables packed with VMProtect. 5 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244bb-62.dat	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1260-79-0x0000000000400000-0x00000000021B0000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1260-100-0x0000000000400000-0x00000000021B0000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1260-120-0x0000000000400000-0x00000000021B0000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/1260-121-0x0000000000400000-0x00000000021B0000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000500000002325a-1.dat	UPX
behavioral1/memory/1844-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1844-119-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000002325a-1.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
1260	DiskGenius.exe

Loads dropped DLL 12 IoCs

pid	Process
1844	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00070000000244bb-62.dat	vmprotect
behavioral1/memory/1260-79-0x0000000000400000-0x00000000021B0000-memory.dmp	vmprotect
behavioral1/memory/1260-100-0x0000000000400000-0x00000000021B0000-memory.dmp	vmprotect
behavioral1/memory/1260-120-0x0000000000400000-0x00000000021B0000-memory.dmp	vmprotect
behavioral1/memory/1260-121-0x0000000000400000-0x00000000021B0000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	DiskGenius.exe
File opened (read-only)	\??\I:	DiskGenius.exe
File opened (read-only)	\??\L:	DiskGenius.exe
File opened (read-only)	\??\P:	DiskGenius.exe
File opened (read-only)	\??\U:	DiskGenius.exe
File opened (read-only)	\??\Y:	DiskGenius.exe
	\??\F:\	DiskGenius.exe
File opened (read-only)	\??\A:	DiskGenius.exe
File opened (read-only)	\??\B:	DiskGenius.exe
File opened (read-only)	\??\J:	DiskGenius.exe
File opened (read-only)	\??\M:	DiskGenius.exe
File opened (read-only)	\??\O:	DiskGenius.exe
File opened (read-only)	\??\T:	DiskGenius.exe
File opened (read-only)	\??\W:	DiskGenius.exe
File opened (read-only)	\??\F:	DiskGenius.exe
File opened (read-only)	\??\H:	DiskGenius.exe
File opened (read-only)	\??\K:	DiskGenius.exe
File opened (read-only)	\??\N:	DiskGenius.exe
File opened (read-only)	\??\R:	DiskGenius.exe
File opened (read-only)	\??\S:	DiskGenius.exe
File opened (read-only)	\??\V:	DiskGenius.exe
File opened (read-only)	\??\X:	DiskGenius.exe
File opened (read-only)	\??\E:	DiskGenius.exe
File opened (read-only)	\??\Q:	DiskGenius.exe
File opened (read-only)	\??\Z:	DiskGenius.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	DiskGenius.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1260	DiskGenius.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000002325a-1.dat	upx
behavioral1/memory/1844-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1844-119-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 64 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive94	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive33	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive35	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive102	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive119	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive38	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive74	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive79	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive13	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive26	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive47	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive75	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive78	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive86	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive32	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive61	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive93	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive105	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive108	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive52	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive53	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive2	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive8	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive21	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive40	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive66	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive103	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive76	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive90	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive112	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive98	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive121	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive122	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive4	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive5	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive39	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive84	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive104	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive115	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive24	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive31	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive57	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive63	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive83	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive85	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive109	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive19	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive92	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive87	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive107	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive25	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive28	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive29	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive44	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive67	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive70	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive18	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive49	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive118	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive125	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive34	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive46	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive69	DiskGenius.exe
File opened (read-only)	\??\PhysicalDrive101	DiskGenius.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiskGenius.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiskGenius.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiskGenius.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	DiskGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A	DiskGenius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 040000000100000010000000069f6979166690021b8c8ca2c3076f3a0f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c0620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f72090000000100000016000000301406082b0601050507030306082b060105050703011400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc1d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e70b000000010000000e00000074006800610077007400650000006800000001000000080000000000876ace99d101030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a1900000001000000100000005dc45e2cd1845791bdde7600050af51020000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442	DiskGenius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob = 5c0000000100000004000000000400001900000001000000100000005dc45e2cd1845791bdde7600050af510030000000100000014000000627f8d7827656399d27d7f9044c9feb3f33efa9a6800000001000000080000000000876ace99d1010b000000010000000e00000074006800610077007400650000001d0000000100000010000000d4803ac36c256817d4ec5936f29bc4e71400000001000000140000005ff3246c8f9124af9b5f3eb0346af42d5ca85dcc090000000100000016000000301406082b0601050507030306082b06010505070301620000000100000020000000ab7036365c7154aa29c2c29f5d4191163b162a2225011357d56d07ffa7bc1f7253000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c00f00000001000000100000005f3d1aa6f471a760663eb7ef254281ef040000000100000010000000069f6979166690021b8c8ca2c3076f3a20000000010000002b0300003082032730820290a003020102020101300d06092a864886f70d01010405003081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d301e170d3936303830313030303030305a170d3230313233313233353935395a3081ce310b3009060355040613025a41311530130603550408130c5765737465726e204361706531123010060355040713094361706520546f776e311d301b060355040a131454686177746520436f6e73756c74696e6720636331283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e3121301f06035504031318546861777465205072656d69756d205365727665722043413128302606092a864886f70d01090116197072656d69756d2d736572766572407468617774652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d236366a8bd7c25b9eda8141628f38ee490455d6d0ef1c1b951647ef1848353a52f42b6a068f3b2fea56e3af868d9e17f79eb46575024defcb09a22151d89bd067d0ba0d92061473d493cb972a009c5c4e0cbcfa1552fcf2446eda114a6e089f2f2de3f9aa3a8673b6465358c88905bd8311b8733faa078df4424de7409d1c370203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010405000381810026482c16c258fae816740caaaa5f543ff2d7c978605e5e6e37632277367eb217c434b9f50885fcc90138ff4dbef2164243e7bb5a46fbc1c6111ff14ab02846c9c3c4427dbcfaab596ed5b7518811e3a485196b824ca40c12ade9a4ae3ff1c349659a8cc5c83e25b79499bb92327107f0865eed5027a60da623f9bbcba6071442	DiskGenius.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	DiskGenius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	DiskGenius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	DiskGenius.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	DiskGenius.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1260	DiskGenius.exe
1260	DiskGenius.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	DiskGenius.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe
1260	DiskGenius.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1260	1844	2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_2be72ff725b5802a455eaf5efc30b6e6_elex_floxif_wannacry.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\DiskGenius\DiskGenius.exe
  "C:\Users\Admin\AppData\Local\Temp\DiskGenius\DiskGenius.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8E4E510F44A56B8C8ECFEC352907C373_F3393D79ACFC752B251321ACCA64CBE6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E4E510F44A56B8C8ECFEC352907C373_F3393D79ACFC752B251321ACCA64CBE6
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

Barray.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\Barray.dll
Size 97KB
SHA256 6f96a533d84574aa6dc2fc0f18a7e63863628de882c9660ac72cdd582d9abea9
MD5 bb850b109e3541cdbe1bb6d1a7876f7a
SHA1 0a8597cfbbefe1243012213c4f6aeab9d2044be1
SHA512 cdf865406428aa81d1b9d1bd2a13c9e2152406fc2e2fb56dd732e3a05bcfb0f7ca626e3fbafe59137d6dd805288a311c0fdef0abb39a73557ac881f537d546bf
SSDEEP 1536:8P+grz4ILeRwmcIwiSCiQxGaqcwoSFsWjcdHDdtBYJ3pgU1/Ahq:8P9f4ILORchwNSqHDdteJ3pgUL
TLSH
T112A36B0136A08075E5EF4A3644B6DB424B3DBE91DFF0D9976F6801895DA03D06F3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Charset.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\Charset.dll
Size 88KB
SHA256 cd7b5549a9ac364bd7134296825c093355b62d29e82d96863aee51ad894991cd
MD5 6f0f6efbe20ea610d41d0c8b38e4645f
SHA1 6545cb2c52ad01baf12582b80339c5aa5605cf2d
SHA512 688c2bfa20424c7300f473634f67042b5dece295c9021e36056676946dc0024563c79d592976f4d8eb1c88b074497e0396a8b56500c554c8dc8e76340aefb699
SSDEEP 1536:z9A9Kds5i+6a2h9oNcLN2sWjcd5J4QTj6/X9/AhgEDp:z9A95cN55J4QTj6/t+
TLSH
T1F7936B0237D19470E5FF4A3544B89A125B3EBE519EF19CAB2F98018A5DA03D06F39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiskGenius.exe

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\DiskGenius.exe
Size 11.5MB
SHA256 9f4d4f1302e9a220b7e14cee35fb35a568aac025b5fcc2f4ed441753e27e9056
MD5 58f192e368d39b93a107ab291684cef5
SHA1 91b7be840392fb4bf8de6b471b0f156ebe7cc616
SHA512 8417aa0a23b8a0cbf815abae40b56262f2ba3f813559648530b1884a3ce0d5d248264f066268098dd0ea117ea1f4770d9d66086ccf894daeb16c0c3ae0531c15
SSDEEP 196608:w4wV7caLFrsZ+M25fXos/O75U/SU+sE/gp+ufGLbQsxQGGfgAOe43nCya+C099M:gRVsZM5fiVUxYgQE47GHy/p9
TLSH
T1D2C633E7E02A4716EBA1957B006E7D6DFA375DCF81532DC680AA84B03CC47BD6F46026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileType.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\FileType.dll
Size 355KB
SHA256 d7d37a82d3fa1139c12c696b98147f7100ff442966dee39565b04b3aee749cf6
MD5 f28d861766e99e22dbd4e8dd84c7c5c8
SHA1 b065fbd190cc4404f9e6e5db877a7d48b6c913bc
SHA512 9aa4443f612907fec37e907dd4c63c6564c145581290b55fdd1aaa93edb1baac3cfcaaccc2d104f0f62e50254f94de1bd4d4beca0b5669dd2cc22436e968f408
SSDEEP 6144:0QFIcAtZkLmLQhctOStN+puDkGNDPQFv7e4R1++qgpmTBpb:0i16Zrj++nN7QFv7lk+qjj
TLSH
T176746B21F66184F5EE7B0634F93F3B0B852D6760A3B499E7D7985D2A0C702C2273925B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwLDM.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwLDM.dll
Size 121KB
SHA256 a47b6752390e389abcf2b10760732dba035aa22b48d748d3af03a31c5492af63
MD5 be971bbbc9524d1abaa1556fff2e66f4
SHA1 38debd137dfb1eaf6213d6d5cc6e7d57ef79b8ea
SHA512 08b1b8b5167bea75f278866edce5f7dcc4f9109cd0a506f88d8c49ff4e61e4fc5c07691cf17da2d2b8013afadcbf141f9022f5b18d6c81a589d891c4f5234163
SSDEEP 1536:JktPXZ1Nfg/Bmd3ALqmSUGVlqexH0KXxUcZtsWjcdUPFD9OZGWdr/Ahc:JktPXve/od3AjSUasu4U9DIoWN
TLSH
T1D7C38E4236D0C071D5EF46794979EA110B3E7F60DFB09CDB2BA8059A1DB02D05F39B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwRD.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwRD.dll
Size 103KB
SHA256 2318ae4bc7bbf1fb5b9ad0a605e94cfb2903e4676efb07c755d42a36a60cc4ce
MD5 5fe4841898724220e1da0b7c3c3d9808
SHA1 48bf8b372301318ca36cc0a36297f07e3146cb9b
SHA512 2e1b4254a3dba2a9238adfe6ea5859065433d21061d72e55a5ce711a9b69f72d0cbc339db13907b30c6dcb37b103c967570882bdf311f7d1133c9704878f0775
SSDEEP 1536:/y+kYsaybAphKjGaAI6xFNZLPcpihSmQHsWjcdw9l1J7h/eAT+/Ahm:SawApta06ihSCw9l1JheATG
TLSH
T122A37D42BAD18071D5EF0A3555BAAB010B3E7A51DFB08C8B7B84128D6DB03D06F3977A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwSmartInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwSmartInfo.dll
Size 524KB
SHA256 cc302fb94cbaa2ace87aee55d234b75b36aaa5e2f13f89b997af7bf43ba98761
MD5 a9a405244eeea19a566b12df2a883379
SHA1 268f01d2cf74038207d89b5bf173aa8d3defe53d
SHA512 b554f254db436c02900339b304e5c2366ad2e7356c5bde4be58c846767fc9b8d0ec9e9822c736413b4da2e80f4d23cc9af8b885eb353aaf5f887ee34c7c5a9cd
SSDEEP 3072:NrrBx7sjWnpHQBmiK1VXD9P28OV6UwRm73V:NrL7sjuN4I1Rm7l
TLSH
T13EB4F6002BEA7819F1B397B156B959268936FD717631CCBF92970A0E0530AC85E35B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwVdi.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwVdi.dll
Size 102KB
SHA256 fdffd2ccab21d228f4e862ae9f54e794d1e0c0635a467687b15f30ec94fb23b0
MD5 3a31b917eb909592f591fb6a1f456f19
SHA1 8dd3b77b67817e437a51b234aaccb38b5efb914a
SHA512 8787473cba00e7ce27a131218df4caaed27d063687cc53cd032b44ac2081720bab75261012c60066904c8bac001a24c17f48f2a5cab323d4eee57395a8a8eee5
SSDEEP 1536:tMESEC9m9HQA6zZw4tmKgnqOO1ob39sEcgYsWjcdAgZ5uUmcRTP/Ah:tuAtQA6z+4abOPCHAgZYUmcRT
TLSH
T1E4A36B1276908079D9EF0A314478DB124B7EBA61DFF06CD72B9901895DF02D06F3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwVhd.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwVhd.dll
Size 105KB
SHA256 90dab6c38b27a73e6bb5e510fd7023158a5b2147475350b4dfd6ff5167a58c89
MD5 7e430626ae1cc35dbf4b82399b151ffa
SHA1 9dc259ce9f7e3dd7b090537b23f7d24c2db4c97d
SHA512 a95274e0fad824e01b6422d494cb44d7b40fef1274dae4263179f8fae74296b7a47cb0b59cd7cbb50c4073c888b2d414c9e3f870a50dc06dbe6fb2b66692c6e2
SSDEEP 1536:GVuc8uCslJ8fz9D2ze6lkjOz8cnAttWsWjcdBCNwxXL/qgx/Ah0:GVJ8uVz8L9wZ8qh0BCNwhL/qs
TLSH
T198B37D42B5909070E9AF0A3555BADB120B7F7A62EFB09C8B7794128D1E713E03F39617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HdrwVhdx.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\HdrwVhdx.dll
Size 104KB
SHA256 96b55c23020243e505f2cb679bdff030facbc5078e172270d1eb0d479cb60bab
MD5 a3055d5c2f74dd0217635fbc40ca1efd
SHA1 a0ed49cd6154ff34d9ab03aa54c7fb46f5a41ae8
SHA512 72b47d24a01229d01739363400335edd23cdd8b93fb3b802d4a277025e28c85383967d4acbf67b4888e7eca11c35f1938766ce0576664695c605a11b394b34f6
SSDEEP 1536:xgh8nmri5LSvd1Hd7XVZ6AON7K1TZcb5862X2sWjcdfAIpIegWCn/Ah:6h8nmri5+vx7FHNasX5fAIp3gWC
TLSH
T1D3A37C02BAD19070D5AF0A354469DB124B7E7E72DFB09C877B9812895E703D06F3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hdrwvm.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\Hdrwvm.dll
Size 131KB
SHA256 7a7dd991fa1ff4893884b728beb97ea102c0ddbceb7d74a6554baa40b84f7295
MD5 e51c7386019d7005d667278b34d3dff8
SHA1 2a4324f3ee682f503390107d25fcc82440d4efe9
SHA512 ba4c344496061b3a808b444f3a6db4930c9cb52c442bc1d61ed1198d0a51effb29f0d8eb5fe975a1a87bc18f0f5427b3b7fdbf766cd16e7ae7d17ff48f7d2118
SSDEEP 1536:N+M+ZYHjO3Zoe28ODsreQnFxzT1r4+IOZc0sWjcdj7CSwOPGHx4zg+/Ahqj:N+VZIjOp08csrLnjTqO8XCSwOSx87
TLSH
T14ED37C1277818471E4EF0A3858A89B565B3FBD74DFB088C7F784029A5DB02C06E7A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangCRes.dll

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\LangCRes.dll
Size 1.3MB
SHA256 a43bb81e94655181e0008477c2c2e462aa3a89ca2a63ddffa7c27a6b12a2f50d
MD5 9738b0890915cabe6aa91b43b4ea3f3f
SHA1 665f9564082d09660028e91007d52883313e4e2d
SHA512 f29f5a82b19b16cfd2f3c00cf959d765eec73810e90ae6751112595a884322eed100cea5e763833903a0e866040cbf49737282a5522b47aeb59642a4c1dfe881
SSDEEP 12288:p0Wg7sGe44WPaiz0y2rCHf3Ib3Z2ASpAwSaShoBTotG7Pu2Ux2:p0WIwWSfQf3MZBSpAwVSh2kE7Pt
TLSH
T140553A71A107D548DC5CA630FF5EAEB21917ADE1A894B63F31427BFA36F22209C91D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Options.ini

Path C:\Users\Admin\AppData\Local\Temp\DiskGenius\Options.ini
Size 2KB
SHA256 2bf82ea91d01a4ed18e5c87ea26b21e447f59dc1d8d713df8d57621123c64297
MD5 0973f0b488b090ef239465b58a19b733
SHA1 eae771bf7e8cddd1d1af614a178999dfffe35a20
SHA512 5386de1212ed26236039e12a33b0862db8fc2d92f68856f001c1b6e537e4ecf01c58910db4e24d7304ed031c35653a43f03ae75489a1ad3f7a1550e19a5b4f0e
TLSH
T16E51E13C8EC9227661B7EAA5C6F649C7FD61B40339225C0E849703890D5BFA7BDC211E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-79-0x0000000000400000-0x00000000021B0000-memory.dmp

Download

memory/1260-77-0x0000000003F70000-0x0000000003F71000-memory.dmp

Download

memory/1260-78-0x0000000003F80000-0x0000000003F81000-memory.dmp

Download

memory/1260-80-0x0000000000D94000-0x0000000001627000-memory.dmp

Download

memory/1260-100-0x0000000000400000-0x00000000021B0000-memory.dmp

Download

memory/1260-120-0x0000000000400000-0x00000000021B0000-memory.dmp

Download

memory/1260-121-0x0000000000400000-0x00000000021B0000-memory.dmp

Download

memory/1844-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1844-119-0x0000000010000000-0x0000000010030000-memory.dmp

Download