floxif | 3f2f7685ecd42094db4152dfa0402f5e788910a7c63997f5802eca793f23e43c

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 13:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
Size 27.6MB
Sample261024-q9c38afa88
SHA256 3f2f7685ecd42094db4152dfa0402f5e788910a7c63997f5802eca793f23e43c
MD5 4c58805cf5b692f17e20d7eb0d923680
SHA1 87ec1e80f8e65a633976b3440f9e6a5e55a1bc11
SHA512 d86f8bb2863ebad3c09a41e01cee09485a5d9f7cb97452ede4d8f1d2ed36b78a8ac9d286d6360060dc771a42f42d67864d92c761742720558167ef73e3836b69
SSDEEP 786432:uVWNqlmJy3Ep5IFxJJzKC30Gz6HLK63ZMxoPTAe:uVwy3EPQEGz6rKcZMmPTAe
TLSH
T18157338CA1F343FAC3425D33444A5C8A8491F62E0926B4C657771EE37E7A7B9A1BB0D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution floxif persistence trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000600000001b85c-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/3512-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x000600000001b85c-1.dat	UPX
behavioral2/memory/3512-188-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\snapman.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\snapman.sys	cmd.exe
File created	C:\Windows\System32\drivers\fltsrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\fltsrv.sys	cmd.exe

Sets service image path in registry 3 TTPs 3 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fltsrv\ImagePath = "System32\\DRIVERS\\fltsrv.sys"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\snapman\ImagePath = "System32\\DRIVERS\\snapman.sys"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\volume_tracker\ImagePath = "System32\\DRIVERS\\volume_tracker.sys"	reg.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001b85c-1.dat	acprotect

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2968	Acronis 2019.exe
3404	Acronis.exe
5616	TrueImage.exe

Loads dropped DLL 21 IoCs

pid	Process
3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe
5616	TrueImage.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3512-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000600000001b85c-1.dat	upx
behavioral2/memory/3512-188-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\msvcr120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\tib_mounter.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\icudt38.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\tib_mounter.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\pcs_io.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\thread_pool.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\zstd.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\snapapi.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\Acronis.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\fox.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libssl10.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\resource.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\vccorlib120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\mspack.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\oem_doc_source.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\Acronis 2019.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\msvcp120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\rpc_client.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\Acronis.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\msvcp120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\tib_api.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\KillDuplicate.cmd	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\icudt38.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\fox.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\libcrypto10.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\kb_link.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\msvcp120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\resource.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\icu38.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\snapapi.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\TrueImage.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\expat.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\TrueImage.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\libssl10.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\resource.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\tib_api.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\fltsrv.sys	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\winpthreads4.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\Acronis.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icu38.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libqrencode.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\resource.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\oem_doc_source.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\mspack.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\vccorlib120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\thread_pool.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\fltsrv.sys	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\fltsrv.sys	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\expat.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\archive3_adapter.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\expat.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libssl10.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\logging.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\msvcr120.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\TrueImage.exe	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\libcrypto10.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icudt38.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\ulxmlrpcpp.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome\kb_link.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Acronis 2019\TrueImageHome\winpthreads4.dll	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
File created	C:\Program Files (x86)\Acronis 2019\TrueImageHome64\snapman.sys	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
712	sc.exe
5368	sc.exe
2004	sc.exe
2088	sc.exe
980	sc.exe
3244	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe
3944	cmd.exe
1904	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	TrueImage.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	TrueImage.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acronis 2019.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TrueImage.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	TrueImage.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	TrueImage.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E7F904D5-83DE-43F6-8EF5-9443DF243CFA}	TrueImage.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{E7F904D5-83DE-43F6-8EF5-9443DF243CFA}\{87E92B0A-33C6-4A1F-BC01-CCA277CFFB63} = 34424239444336413030303030303030	TrueImage.exe

Modifies registry key 1 TTPs 43 IoCs

Modify Registry

T1112

pid	Process
4608	reg.exe
5152	reg.exe
1076	reg.exe
1732	reg.exe
3968	reg.exe
1468	reg.exe
4852	reg.exe
3268	reg.exe
1224	reg.exe
3024	reg.exe
4652	reg.exe
1084	reg.exe
552	reg.exe
2640	reg.exe
1180	reg.exe
2976	reg.exe
3856	reg.exe
5228	reg.exe
5904	reg.exe
3096	reg.exe
1004	reg.exe
5640	reg.exe
4568	reg.exe
1356	reg.exe
3192	reg.exe
2696	reg.exe
5332	reg.exe
1980	reg.exe
4976	reg.exe
6004	reg.exe
4356	reg.exe
2748	reg.exe
1368	reg.exe
4964	reg.exe
1540	reg.exe
5648	reg.exe
6016	reg.exe
764	reg.exe
2964	reg.exe
5104	reg.exe
1840	reg.exe
2592	reg.exe
4280	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
Token: 33	5616	TrueImage.exe
Token: SeIncBasePriorityPrivilege	5616	TrueImage.exe
Token: SeSystemEnvironmentPrivilege	5616	TrueImage.exe
Token: SeBackupPrivilege	5616	TrueImage.exe
Token: SeRestorePrivilege	5616	TrueImage.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5616	TrueImage.exe
5616	TrueImage.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4944	3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe	90
PID 3512 wrote to memory of 2968	3512	2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe	92
PID 2968 wrote to memory of 3944	2968	Acronis 2019.exe	93
PID 3944 wrote to memory of 3404	3944	cmd.exe	95
PID 3404 wrote to memory of 1904	3404	Acronis.exe	96
PID 1904 wrote to memory of 1224	1904	cmd.exe	98
PID 1904 wrote to memory of 3192	1904	cmd.exe	99
PID 1904 wrote to memory of 3024	1904	cmd.exe	100
PID 1904 wrote to memory of 6004	1904	cmd.exe	101
PID 1904 wrote to memory of 2696	1904	cmd.exe	102
PID 1904 wrote to memory of 4356	1904	cmd.exe	103
PID 1904 wrote to memory of 4652	1904	cmd.exe	104
PID 1904 wrote to memory of 1084	1904	cmd.exe	105
PID 1904 wrote to memory of 1540	1904	cmd.exe	106
PID 1904 wrote to memory of 2004	1904	cmd.exe	107
PID 1904 wrote to memory of 2088	1904	cmd.exe	108
PID 1904 wrote to memory of 5332	1904	cmd.exe	109
PID 1904 wrote to memory of 2748	1904	cmd.exe	110
PID 1904 wrote to memory of 5648	1904	cmd.exe	111
PID 1904 wrote to memory of 5228	1904	cmd.exe	112
PID 1904 wrote to memory of 5152	1904	cmd.exe	113
PID 1904 wrote to memory of 980	1904	cmd.exe	114
PID 1904 wrote to memory of 3244	1904	cmd.exe	115
PID 1904 wrote to memory of 1076	1904	cmd.exe	116
PID 1904 wrote to memory of 1980	1904	cmd.exe	117
PID 1904 wrote to memory of 1732	1904	cmd.exe	118
PID 1904 wrote to memory of 6016	1904	cmd.exe	119
PID 1904 wrote to memory of 2964	1904	cmd.exe	120
PID 1904 wrote to memory of 712	1904	cmd.exe	121
PID 1904 wrote to memory of 5368	1904	cmd.exe	122
PID 1904 wrote to memory of 3968	1904	cmd.exe	123
PID 1904 wrote to memory of 4608	1904	cmd.exe	124
PID 1904 wrote to memory of 5104	1904	cmd.exe	125
PID 1904 wrote to memory of 4568	1904	cmd.exe	126
PID 1904 wrote to memory of 1356	1904	cmd.exe	127
PID 1904 wrote to memory of 1840	1904	cmd.exe	128
PID 1904 wrote to memory of 2592	1904	cmd.exe	129
PID 1904 wrote to memory of 5904	1904	cmd.exe	130
PID 1904 wrote to memory of 5640	1904	cmd.exe	131
PID 1904 wrote to memory of 552	1904	cmd.exe	132
PID 1904 wrote to memory of 764	1904	cmd.exe	133
PID 1904 wrote to memory of 4976	1904	cmd.exe	134
PID 1904 wrote to memory of 4280	1904	cmd.exe	135
PID 1904 wrote to memory of 1468	1904	cmd.exe	136
PID 1904 wrote to memory of 1368	1904	cmd.exe	137
PID 1904 wrote to memory of 4852	1904	cmd.exe	138
PID 1904 wrote to memory of 2640	1904	cmd.exe	139
PID 1904 wrote to memory of 4964	1904	cmd.exe	140
PID 1904 wrote to memory of 3268	1904	cmd.exe	141
PID 1904 wrote to memory of 1180	1904	cmd.exe	142
PID 1904 wrote to memory of 2976	1904	cmd.exe	143
PID 1904 wrote to memory of 3096	1904	cmd.exe	144
PID 1904 wrote to memory of 3856	1904	cmd.exe	145
PID 1904 wrote to memory of 1004	1904	cmd.exe	146
PID 1904 wrote to memory of 4428	1904	cmd.exe	147
PID 1904 wrote to memory of 5840	1904	cmd.exe	148
PID 3944 wrote to memory of 5724	3944	cmd.exe	149
PID 3944 wrote to memory of 3768	3944	cmd.exe	150
PID 3944 wrote to memory of 3744	3944	cmd.exe	151
PID 3944 wrote to memory of 2532	3944	cmd.exe	152
PID 3944 wrote to memory of 3656	3944	cmd.exe	153
PID 3944 wrote to memory of 5524	3944	cmd.exe	154
PID 3944 wrote to memory of 5108	3944	cmd.exe	155
PID 3944 wrote to memory of 3984	3944	cmd.exe	156

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ""C:\Program Files (x86)\Acronis 2019\KillDuplicate.cmd" "C:\Program Files (x86)\Acronis 2019" "2026-10-22_4c58805cf5b692f17e20d7eb0d923680_driverpack_elex_floxif_wannacry.exe""
  2⤵
  - Executes a command shell one-liner
  PID:4944
- C:\Program Files (x86)\Acronis 2019\Acronis 2019.exe
  "C:\Program Files (x86)\Acronis 2019\Acronis 2019.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8CXUFJSD.bat" "C:\Program Files (x86)\Acronis 2019\Acronis 2019.exe" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Program Files (x86)\Acronis 2019\TrueImageHome64\Acronis.exe
      "C:\Program Files (x86)\Acronis 2019\\TrueImageHome64\Acronis.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CXYGEB65.cmd" "C:\Program Files (x86)\Acronis 2019\\TrueImageHome64\Acronis.exe" "
        5⤵
        Drops file in Drivers directory
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKLM\SYSTEM\ControlSet001\Services\snapman /ve
        6⤵
        Modifies registry key
        
        PID:1224
      - C:\Windows\system32\reg.exe
        
        REG QUERY HKLM\SYSTEM\ControlSet001\Services\fltsrv /ve
        6⤵
        Modifies registry key
        
        PID:3192
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ErrorControl" /T REG_DWORD /D "0"
        6⤵
        Modifies registry key
        
        PID:3024
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "DisplayName" /T REG_SZ /D "Acronis Storage Filter Management"
        6⤵
        Modifies registry key
        
        PID:6004
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Group" /T REG_SZ /D "Filter"
        6⤵
        Modifies registry key
        
        PID:2696
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\fltsrv.sys"
        6⤵
        Sets service image path in registry
        Modifies registry key
        
        PID:4356
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Start" /T REG_DWORD /D "0"
        6⤵
        Modifies registry key
        
        PID:4652
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Type" /T REG_DWORD /D "1"
        6⤵
        Modifies registry key
        
        PID:1084
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\fltsrv /f /v "Tag" /T REG_DWORD /D "2"
        6⤵
        Modifies registry key
        
        PID:1540
      - C:\Windows\system32\sc.exe
        
        sc.exe create fltsrv type= kernel start= boot binpath= "System32\DRIVERS\fltsrv.sys"
        6⤵
        Launches sc.exe
        
        PID:2004
      - C:\Windows\system32\sc.exe
        
        sc.exe start fltsrv
        6⤵
        Launches sc.exe
        
        PID:2088
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "DisplayName" /T REG_SZ /D "Acronis Snapshot Manager"
        6⤵
        Modifies registry key
        
        PID:5332
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ErrorControl" /T REG_DWORD /D "1"
        6⤵
        Modifies registry key
        
        PID:2748
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\snapman.sys"
        6⤵
        Sets service image path in registry
        Modifies registry key
        
        PID:5648
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Start" /T REG_DWORD /D "0"
        6⤵
        Modifies registry key
        
        PID:5228
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\snapman /f /v "Type" /T REG_DWORD /D "1"
        6⤵
        Modifies registry key
        
        PID:5152
      - C:\Windows\system32\sc.exe
        
        sc.exe create snapman type= kernel start= boot binpath= "System32\DRIVERS\snapman.sys"
        6⤵
        Launches sc.exe
        
        PID:980
      - C:\Windows\system32\sc.exe
        
        sc.exe start snapman
        6⤵
        Launches sc.exe
        
        PID:3244
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\volume_tracker /f /v "Group" /T REG_SZ /D "PnP Filter"
        6⤵
        Modifies registry key
        
        PID:1076
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\volume_tracker /f /v "ErrorControl" /T REG_DWORD /D "1"
        6⤵
        Modifies registry key
        
        PID:1980
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\volume_tracker /f /v "ImagePath" /T REG_SZ /D "System32\DRIVERS\volume_tracker.sys"
        6⤵
        Sets service image path in registry
        Modifies registry key
        
        PID:1732
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\volume_tracker /f /v "Start" /T REG_DWORD /D "0"
        6⤵
        Modifies registry key
        
        PID:6016
      - C:\Windows\system32\reg.exe
        
        REG.exe ADD HKLM\SYSTEM\ControlSet001\Services\volume_tracker /f /v "Type" /T REG_DWORD /D "1"
        6⤵
        Modifies registry key
        
        PID:2964
      - C:\Windows\system32\sc.exe
        
        sc.exe create volume_tracker type= kernel start= boot binpath= "System32\DRIVERS\volume_tracker.sys"
        6⤵
        Launches sc.exe
        
        PID:712
      - C:\Windows\system32\sc.exe
        
        sc.exe start volume_tracker
        6⤵
        Launches sc.exe
        
        PID:5368
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "icu38.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icu38.dll"
        6⤵
        Modifies registry key
        
        PID:3968
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "resource.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\resource.dll"
        6⤵
        Modifies registry key
        
        PID:4608
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "archive_mount_helper.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\archive_mount_helper.dll"
        6⤵
        Modifies registry key
        
        PID:5104
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "logging.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\logging.dll"
        6⤵
        Modifies registry key
        
        PID:4568
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "archive3_adapter.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\archive3_adapter.dll"
        6⤵
        Modifies registry key
        
        PID:1356
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "pcs_io.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\pcs_io.dll"
        6⤵
        Modifies registry key
        
        PID:1840
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "zstd.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\zstd.dll"
        6⤵
        Modifies registry key
        
        PID:2592
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\BackupAndRecovery\Commoncomponents /F /V "winpthreads4.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\winpthreads4.dll"
        6⤵
        Modifies registry key
        
        PID:5904
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "icu38.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icu38.dll"
        6⤵
        Modifies registry key
        
        PID:5640
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "rpc_client.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\rpc_client.dll"
        6⤵
        Modifies registry key
        
        PID:552
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "resource.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\resource.dll"
        6⤵
        Modifies registry key
        
        PID:764
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "thread_pool.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\thread_pool.dll"
        6⤵
        Modifies registry key
        
        PID:4976
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "libcrypto10.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libcrypto10.dll"
        6⤵
        Modifies registry key
        
        PID:4280
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "libssl10.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libssl10.dll"
        6⤵
        Modifies registry key
        
        PID:1468
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "kb_link.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\kb_link.dll"
        6⤵
        Modifies registry key
        
        PID:1368
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "ulxmlrpcpp.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\ulxmlrpcpp.dll"
        6⤵
        Modifies registry key
        
        PID:4852
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "expat.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\expat.dll"
        6⤵
        Modifies registry key
        
        PID:2640
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "tib_api.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\tib_api.dll"
        6⤵
        Modifies registry key
        
        PID:4964
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "tib_mounter.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\tib_mounter.dll"
        6⤵
        Modifies registry key
        
        PID:3268
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "oem_doc_source.dll" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\oem_doc_source.dll"
        6⤵
        Modifies registry key
        
        PID:1180
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "auto_reactivate.bin" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\auto_reactivate.bin"
        6⤵
        Modifies registry key
        
        PID:2976
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Commoncomponents /F /V "auto_reactivate64.bin" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\auto_reactivate64.bin"
        6⤵
        Modifies registry key
        
        PID:3096
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\Trueimage /F /V "standard" /T REG_SZ /D " 3102 1 2108 29 29 12120 24 16 30 99108 1 20 1120 2 23103 0 7 24 22 29120 0 1 25 15 18 27 12 5120 3 1 31 17 16 12 25 22120 99 2 18 19 99 27 27 97120 13102 16 99 20 1 12 23120 98 31 29109 98 24 20 0"
        6⤵
        Modifies registry key
        
        PID:3856
      - C:\Windows\system32\reg.exe
        
        REG ADD HKLM\SOFTWARE\Acronis\TrueImageHome\Settings /f /v "WorkingDir" /T REG_SZ /D "C:\Program Files (x86)\Acronis 2019\TrueImageHome64\
        6⤵
        Modifies registry key
        
        PID:1004
      - C:\Windows\system32\reg.exe
        
        REG QUERY "HKLM\SYSTEM\ControlSet001\Control" /v SystemStartOptions
        6⤵
        
        PID:4428
      - C:\Windows\system32\find.exe
        
        find /i "MININT"
        6⤵
        
        PID:5840
  - - C:\Windows\system32\reg.exe
      Reg Delete "HKLM\SOFTWARE\Acronis\CommonComponents" /f
      4⤵
      PID:5724
  - - C:\Windows\system32\reg.exe
      Reg Delete "HKLM\SOFTWARE\Acronis\TrueImage" /f
      4⤵
      PID:3768
  - - C:\Windows\system32\reg.exe
      Reg Delete "HKLM\SOFTWARE\WOW6432Node\Acronis" /f
      4⤵
      PID:3744
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis" /f
      4⤵
      PID:2532
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "resource.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\resource.dll" /f
      4⤵
      PID:3656
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "icu38.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\icu38.dll" /f
      4⤵
      PID:5524
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "libcrypto10.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\libcrypto10.dll" /f
      4⤵
      PID:5108
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "thread_pool.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\thread_pool.dll" /f
      4⤵
      PID:3984
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "libssl10.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\libssl10.dll" /f
      4⤵
      PID:1756
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "kb_link.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\kb_link.dll" /f
      4⤵
      PID:972
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "rpc_client.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\rpc_client.dll" /f
      4⤵
      PID:5932
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "tib_api.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\tib_api.dll" /f
      4⤵
      PID:3784
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "tib_mounter.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\tib_mounter.dll" /f
      4⤵
      PID:4176
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "oem_doc_source.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\oem_doc_source.dll" /f
      4⤵
      PID:5688
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "ulxmlrpcpp.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\ulxmlrpcpp.dll" /f
      4⤵
      PID:4684
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "expat.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\expat.dll" /f
      4⤵
      PID:1616
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "logging.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\logging.dll" /f
      4⤵
      PID:5004
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "boot_assist.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\boot_assist.dll" /f
      4⤵
      PID:1700
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "mspack.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\mspack.dll" /f
      4⤵
      PID:988
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "backup_worker.exe" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\backup_worker.exe" /f
      4⤵
      PID:4784
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "archive3.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\archive3.dll" /f
      4⤵
      PID:1448
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "archive3_adapter.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\archive3_adapter.dll" /f
      4⤵
      PID:456
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "file_backup.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\file_backup.dll" /f
      4⤵
      PID:744
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "onig.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\onig.dll" /f
      4⤵
      PID:3912
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "pcs_io.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\pcs_io.dll" /f
      4⤵
      PID:416
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "winpthreads4.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\winpthreads4.dll" /f
      4⤵
      PID:5328
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "zstd.dll" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\zstd.dll" /f
      4⤵
      PID:2556
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "auto_reactivate.bin" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\auto_reactivate.bin" /f
      4⤵
      PID:4564
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\CommonComponents" /v "auto_reactivate64.bin" /t REG_SZ /d "x:\Program Files\Acronis\TrueImageHome64\auto_reactivate64.bin" /f
      4⤵
      PID:3448
  - - C:\Windows\system32\reg.exe
      Reg Add "HKLM\SOFTWARE\Acronis\TrueImage" /v "standard" /t REG_SZ /d " 16 15 12109 19 30 12 7120 99 96 0 18 30 96103 29120 24 99 20 0102 20 20 3120 2 15 0 13 24 0 4 29120 30 13 16 27109108103 31120 30 16 2 30 29 7 3 22120 6 2102 97 29 4 19 18120102 22 19 19 25108 4 96" /f
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Acronis 2019\TrueImageHome64\TrueImage.exe
      TrueImage.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Acronis 2019.exe

Path C:\Program Files (x86)\Acronis 2019\Acronis 2019.exe
Size 418KB
SHA256 706bdb4500d08032ff0c7b8b1776656710030df792f6b9de5150acb6807d8e0f
MD5 15bcf61352eb62fc0fa80c0098d130aa
SHA1 5e009d93ea0a12e6eed36a3e55ea94973b5ffe19
SHA512 3ace36d4b60c45eb6f6d5640588af9344b8b3746818fa3a6a494055966764a6319603282d490630fbb37e55d395c601adf3e5a11fcfdd61b69cffe211f7a8a85
SSDEEP 3072:7bFJiSEiakHBCd+LcHEFomjMKP1YHCJqZVEl6OV65dPheZ5:PFJp4VEl6OVWxO
TLSH
T15894F00A7EA1CC40F88BC2B6D51D16F967237E1CC36A701796AB3ED83B756A8079503D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acronis.exe

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\Acronis.exe
Size 579KB
SHA256 0e08db9995710627da6775c8dc4ada002aa71fbcc4d4d783ff3084ede9c23fbb
MD5 449f14e046048790c418a19fd4ff7e81
SHA1 65e0e4fe49fda39c5ad82997f1107f72bf1842b8
SHA512 fe9ee387316dd5b581bd09845552f789d681fb73e6eba5da6aaaa5355154bb6dedb5f3e01c20f0867a59f24d10955dd41c53c087c935612c5a831a235a63916a
SSDEEP 3072:AvcFtu+Ylnh6ka3TGWRkHBCd+LcHEFtmjMKP1YHXJUfVEl6OV65dPhekLi4f:7Fg+yhXaDGWBVEl6OVWxLNf
TLSH
T148C4600BBA908E72F8468176C45B43F5622B7D2C83E670975E973FCE27755D88B78028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\MSVCP120.dll
Size 644KB
SHA256 2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848
MD5 46060c35f697281bc5e7337aee3722b1
SHA1 d0164c041707f297a73abb9ea854111953e99cf1
SHA512 2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a
SSDEEP 12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
TLSH
T11EE44C13FB150AB0E192D3B891D74741D7F1BC898822E70752ABE27D5F67391AA2F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\MSVCR120.dll
Size 940KB
SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
MD5 9c861c079dd81762b6c54e37597b7712
SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
TLSH
T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TrueImage.exe

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\TrueImage.exe
Size 36.5MB
SHA256 6791d651d7e2f4eefb3a25b3b6cc898e524ca80d2bf27b810add79eb33a9da66
MD5 dec2c20e3e6ab33c78e5dc9d6966affa
SHA1 7480c218ae0f83b3ef72ba4aa969c0fb419a0761
SHA512 d957aee7af6788bdb1b4ef42aca78522a9383543eacade0697197364b1f3c57a04fc6127af8bfea6289e0bff16323b80674c99ee2f166942fcbb3ddee99fbf71
SSDEEP 393216:jXkD+76e3HYyHcrd6mRaecCsXPU1OqDWA08HLJKID/yxVbNxrNOV6so5mrP3IjLn:7kDXRJzs2W5hzPCT7j8ehxmYv
TLSH
T177878C5A3AB480D5D077C1788AA68246F7B2B8254B35AFDF1162175E1F3BAF04E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

archive3_adapter.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\archive3_adapter.dll
Size 184KB
SHA256 5732cb84ded24379d0a3a706b539bc7c3cfec1ecca782ce04d4c6ec2cd28639b
MD5 cf804353461e93129f9cfaf96266dcf2
SHA1 fc04e9445c41b6b4e4de02d404ccd2a444dcbf0c
SHA512 e04db11ee0250a324f683f881efa2521376017ddbb90c0343a11eb66ab866473c5994a20bf9cfc593d2475f261db35a371039d604efaca5c353b327f0a4609df
SSDEEP 3072:hCIIk3f3pu8Xj7QyUG5ZBdILOAwzi8woWBmwyxaHcGHHeSDFhJ:oMxu8XwyPOLOAgiy5N4Hc2HeSD3
TLSH
T120043A0A27E84152F2B3A77D49B64902DBB2B855AF75CBCF5250428E0F33BD08D75B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fltsrv.sys

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\fltsrv.sys
Size 178KB
SHA256 fb4b226fe56f34e21cf8a3e07c262f1d55bf1be5e2977e9a7982950104c58115
MD5 1c55d52d031c12b3b44bf560f110b3bd
SHA1 01ed7db8225aafcd55b1630a35f6f73f013a51bd
SHA512 72c1aac244ffe3b3c425b22a1c12fdb00a6c22bedfe66c42f511a680fa00d7ed0dd7ab64fbf787f97856644f6a84ab49e01fab187f25e387fedcb377d27c52f6
SSDEEP 3072:872T27nRBUS2XazoKT4V6LjCMJP3ts+I4pGU55e1ZM5V:8qTmFEVU1l3ts14pGU55mm
TLSH
T1C2043A4763B410E5E177E27DCA91841BE7F1B4A15736DACF039446A62F237E0AE39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fox.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\fox.dll
Size 2.0MB
SHA256 029b9df9a4532c3c41cdbb645fda3f4b9b532f39b848826d8eadef4ad9334f39
MD5 0a55599441ee1739f751befce0b5404a
SHA1 40a466c7c5b8bb0b95a795686093e99beb93b453
SHA512 a83b8c10f87aa0892f7bdc1a7a6a8143c40bfcd1b937b95cf9dd14a261debcc6c5a93c2e0f792e39c5c0211019730811daa4653f3f4f0e8d13cec2e2b4330149
SSDEEP 24576:/LzDcCkrK6ZDQl+EAT9fRv0U9fi4cpEIz76uFejWBGFCjPQKUgTJVkfafkf00pp6:/LuDQl2NRv7fuEduFejWBPQATXtkfvg
TLSH
T1C1A57B4FBBBA00A2C467D23CC5E78116EAF37464072A9FCF4565821E6F237D1497A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icu38.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icu38.dll
Size 1.6MB
SHA256 e3fe1c305dcea41451517de463d05c18c25975eca47c6ec1da6b2e79aa0351f8
MD5 1c75409e3b6bac71fe75964f4c37539c
SHA1 8da1de86c531e1ca3fa1c02ffdcf0bf21622ac31
SHA512 0527f8cf2ffe5d638fb28dfc3ce6cee667a10b88ba0cf1faedbab528e224586c0a041732ca40b97e1c9922ae9df576bf52f15551d1aea9f8823c1f71fdaea1d5
SSDEEP 24576:W9SZAwzD/BdQXYfPsFVZyiNdFdmEkkkkkkkkkkkkkkUkkkkkkkkkkkkkkkkkkkkC:W9Tw3oXYfyPyiNdFvYA
TLSH
T1ED756B93F35640A6C5A7D139C4A70B0BF2B178214F629EEB06650FAD3E63BD025BE354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudt38.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\icudt38.dll
Size 3.6MB
SHA256 7e092cf068b00b9c3882ac96d9589cb141f3d1ae9969c74611fdc5d9b4cd4ac1
MD5 7a70f64c2352fcf134dac897a461d1a1
SHA1 f826cc5d6a5175592af3e6d03ecb85060bde42f2
SHA512 656701f2de2bf5ee7fbba2584fbd24170c29dcc5acdd142bc4c9189c45b8a73df1bf3fb24e2a7a19340bec8a4c1eed8102ef4fd84ac277d2bd84b72ed715e5e9
SSDEEP 98304:UD9APUf4EHGAfGtnDg2jW7wflVe8yPIDXJHPUpyMh:U5APwjHx+nHNDZi
TLSH
T182062813E7E50907FDB39EF875F65202B633FC527F31C8CA9160262E79A36804654B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kb_link.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\kb_link.dll
Size 310KB
SHA256 94a928cb90e723a1d9d122a1000a9d66a04659ff719403d4c6f898654fd9213c
MD5 13127e0382ec8614fd93a66186b21ff8
SHA1 e028b5f59574b8ddf0a2e2223278cc8c59994818
SHA512 02a89de1098b8c3e6e2fb1e8f773e8f777b61363f97b993f0571637421bfc20a0c25d7f7382b11310ac1308077a0fd2f3a96f306baaccd6b317504a905d441ad
SSDEEP 6144:la9nUlZMtYKSCdwZOAc5uqE/HBgGkhd9ykp+Rz2l:lQTw8pE/2RUr
TLSH
T104646B1A3BE84061E1B3A67C95E24942FBB2B8456F749BCF0251437E1E37BE05D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto10.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libcrypto10.dll
Size 2.2MB
SHA256 5b43cc5beab022107c45c9f3721d2e8832f9aa935853d7949e19d28dd7fdfd87
MD5 09d45f937a599d060468c616ecc9b7da
SHA1 0ee67fe88647934a3bb4b5b9220ca84c177f070f
SHA512 5e55f581e98c88fd2ca1c9fb6c11990a59ba8b4040a9abfc9425ca793d6b882b65bc02d94e221bc4704c0ad0ff1b5a720c7699cf64f4253250ae660d2e9dea0f
SSDEEP 49152:1GtlqdEJVwASOednLOzEKSFnaCeX42f6v8jTPwMrD5AxOW2LXJTYiTBPW8x6bUqv:uYoEleHKOIiTHx6bUqrT
TLSH
T193A59E1D669800D2DAB6D174D8B3872BF7B1F85503F0DBEB2A5086981E13FE95379B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl10.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\libssl10.dll
Size 406KB
SHA256 355e42db1b6865442cf8d847672ae9866efaaaaae18326bef2a30b25d8c6f58b
MD5 2b5d8a19e3867b408dbe6b4c5aae5f0c
SHA1 d78fe20593233d5f805cb2a033f9e610204d9c14
SHA512 7ec1918b539f9c4ebcb4e98d4176f81566ad838347472e6565ffca8237bcae8555b673504c7bf01390f0346cd38e0d36e326455e309f0f42792d14292f86c011
SSDEEP 12288:I9MbXLlre1Rghz4Pf/E+hynC/djYMwg6+mCmSYFbVOliVs34UUp7v4gAR9kwzDvz:xesVll4IG7mwd
TLSH
T1B694195937A5088AD9D3C17482238BABBB79F85513FC8AC73E21811E1F137E016797E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\logging.dll
Size 492KB
SHA256 9a50df813d7ee43104ac77e59cee4b95715d9a2e7d4555308cdecd2beb7ecc9e
MD5 7b4e5102c18aad12c77412c926aac118
SHA1 a32380b42a782c575c2edc38425c101a32367e4c
SHA512 9ee8bda1d2246fd40e6672e9738dd7774813d10d1cbb0c9b8ea64395937678031c1816ed77dd7db9c73d7406e0669a3c2e84141657fda5357e220f91d7e865b5
SSDEEP 6144:V32j7Hbe77JmG/sFk/eSE3zb2bopATYsWQ5hsm4obQhrGF/vhsYK1cJvaTnFTB28:V3i4JOz9AFJchoH21csTFTg+kNF4Jak
TLSH
T11CB46B1DAB680162D166D17C86D78A46E6B274141F719FCF82A1E33E2F33BE4193E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem_doc_source.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\oem_doc_source.dll
Size 1022KB
SHA256 d3acd7de032e333fb60bfb5914acc41a93cd058fa47dbecdc938f56663a0e4da
MD5 e51c5b2e28b49178b26cbebc161062d5
SHA1 1457d307a39eb3f2d4ee9b9a760b91673fa7b41d
SHA512 8988c314370f62bf80be84c68657a8615e2574ab02083c77d7fccc63f658fa2edb4ab4f6cb68ed7d1dbc7d5910040142621bcf24d83171ae8b1fc63610d021de
SSDEEP 12288:QOI7m51TwgGTe0hNuvnDcAxsfoyowMyarN8sSXDNbFnIyIdz1Wj4O:LcwTwy+Nutufpowc8sS3nI5zIsO
TLSH
T1DC25E11EAA944851E137C63989EB8502F7B2B8196B74EADF1654062E7E37FE0CC3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcs_io.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\pcs_io.dll
Size 319KB
SHA256 278aea296b29612d321a8c41cb682c62effef4bc2598a3c0c1bb39ee2a775863
MD5 afd8bc5b73c812822e5ff3c2c6ccd028
SHA1 51dcfb157dbc6211e3db1f338c347fe4c0a64fd3
SHA512 815736bbd8834e8eaec8bfd1f4b886a03856c15980476bc85664ca23e746db261726e0e4ce87838d8722e3e802de0c2a2da841b4e327704cfc6588c80bb6b382
SSDEEP 6144:WqyEYWFCrqL5XHzABcpxTBqIqgMs9F4g3yepIIbSIx:WqyRqL6BcpxTsIqgMs9FDhx
TLSH
T1F2644A5216304C25EA33847E77E39621DA737C0D275093CB77B09AA96F23BE2857E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resource.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\resource.dll
Size 474KB
SHA256 98db354155ef9316ac2f0808aa8ec16876c967ce102f42da29fdc45f0aef9c8b
MD5 765695e2a28b71b94526d78fbe862c18
SHA1 c9818a9aec348a02b8aebf71c6a043719f5a1bf9
SHA512 bcbfa88f6e3787ffb8af672135ed24f9b69fb6555c4b31e6c8aa901596ac66b57a8068578318379e9f381f2d3a59902b448e8bdb9dfc979c2dd6d4a31d1499b0
SSDEEP 6144:xp+lqOmqnR5G0Hir7fT43IcDWDCr+kJ+1omk2TB+cVnIpdfOAislZ:v0fHLWuiq6k2TPIpoc
TLSH
T15AA44B1EAB984851E177863D89F78A06F771B8185B35EBDF1154A23D2E37BE0883D312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapapi.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\snapapi.dll
Size 648KB
SHA256 23c76ed9dee0cd26306c90c7091eec8a49c6542746973e63ae4582e8aae73bfc
MD5 e24fb4333c5442c792f78de2bcde53ed
SHA1 1c921935485f7c84c45039eaa89ef014cadb9f6c
SHA512 c703d98283f85cf64df9f979a1e78d64778a429706fb506c73740bc7d2e9984d1bcae7590bc9bfa46b2a60765cca84f7e759c9b5c4022191e48bd34663767b2e
SSDEEP 12288:cIiOzA1GtyJCVaR6ug0cjyAGjjRakfRQk287G:gOM1G4J2aMugdOAGj91RQw7G
TLSH
T1A5E43B1A6BA441A5D077C239CA938152F7B278115F709BCF13A5926F2E37BD48F39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snapman.sys

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\snapman.sys
Size 365KB
SHA256 f0c6abe44e184e7f7bdc97912d7b3478710ca7331dc7870e4dcf158f658539ba
MD5 56e08e4d067ddd64a994838b3a89b590
SHA1 1eb1a816d5617396abdb2dfe84f95a4abba64701
SHA512 473139a1e5153cfcefde9e1d34c62f939c400b08a687a26cd3b7aa8c46ce70d62502066977020325e60ccaadaeed37f7634a34588e9194f9b63bfe966a0c1e93
SSDEEP 6144:yt+kL8OFMaXHtJzthAigwpzB/1HQSopU2LlWHn1CFNc4b4QocFCp:yt+u8OFFHtbhAmpN/1LoLgH1sb4QocF
TLSH
T1AA845B4A67F414E0F1B792BCCA624007FBB1789A9775C6CF07A48A866F537E0AD35312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thread_pool.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\thread_pool.dll
Size 61KB
SHA256 be079c336675946f8074901037be153430f94ba8143b079b0d03591b2a902249
MD5 70b56f5b0c8792b2a55c857f9bc81bfc
SHA1 fe4b0bb97cb557327e9f8793a5f218998aca21d0
SHA512 297146e6de2ba49bd517b49d636dfcaab92346444fcb157d39a8921b51ed3d74cc0a77751e75b0031a9d76ec493ad8891fb67d7ab8f9331607f6512bc49346f2
SSDEEP 768:MVXD9MKMlXhW0LkSZkgwtl6BQZ9X3Mc1bOAyXmgB2Dmp2HFI2HMpS:MZDuJlRW+c3Mc1bOAy2gB2DflHs
TLSH
T18453194B3BBC4452F2728A7D85F68906D9F3B8416F7686CF1221434E1E37BD09A79326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winpthreads4.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\winpthreads4.dll
Size 49KB
SHA256 56149386a85df2380588e9c8902c6cdaf9003270bc3b1cf247bad2413b9ff259
MD5 e4ee2845ade80e738d458e940d87f9ba
SHA1 e3af03a337a4e6143a4f8ad7606afcef393f148d
SHA512 6edc808115dd22eefcd80a8e798f6ed85248b26d9b271d5abea4c31027011330e37207e91204ac58109f4dec02f2cc478f7040342741bea4b30b49831de232b2
SSDEEP 768:UwAwx5WzT0OttBnCdu7cKrG+XSsJ6gSLmK2jTimcYSSMP1ZQKIIBriBD7:Uwc09/8G+lbK2jTimcYSSMd6MriBD7
TLSH
T1D8334B8A172800E6E6924939C2E24986D27374121725FBCFE774C3571FA7BC0E67939D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zstd.dll

Path C:\Program Files (x86)\Acronis 2019\TrueImageHome64\zstd.dll
Size 283KB
SHA256 6b90721344ce27803175d667affde37f2a5dc560988641fce859a3a7abe9e147
MD5 18291ce257f010f01706ad5131aff918
SHA1 f9795f477bde2838ad778e98ce0f3d830ac88efb
SHA512 8d3096a9dd5f85e59e959162effa47ea6b526b2b88e066f5100bb190e25d82fb50acc50a825d79e54c17f0fd6383c0e1554d87063aaa40d9d4afb202f942e885
SSDEEP 6144:4GpacT69Jks45R7HOdbkGVCFEYuXiZFKbl:7m9Jk/oDQml
TLSH
T190549E43BB4619A9C06FD079C563931BEA753846130966EF43F4C6232E17BF05B3A39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CXUFJSD.bat

Path C:\Users\Admin\AppData\Local\Temp\8CXUFJSD.bat
Size 8KB
SHA256 178ad77c160c4aacbf7c2da0edbe9e7d1681532c93ae50acd939527cb15ba0b9
MD5 c0089141b022eabf4e2b6d4fe6d8995d
SHA1 5df8c2fec139dfde2674e9af98245487337dfbbd
SHA512 fef54e0b04c003cea17f2bcff425c72165c9a6ca7b3c854d88f1ad03871d86134b023fcc1fcaee8ba9e9c36e645fb97698d875f0b80aaacc3c1fbc1d1a61ed56
SSDEEP 192:/7IYE8EEWAsU+UA0Cw1M1fWxcCtouO4gFuOGOOOWOiIG6mg2SCga1u1fMxOotaYN:cWC9M4E
TLSH
T1A5020CB1BDF38073A044B1107F90BC8F26CACEE72FD2433535556786826E953A6B61E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CXYGEB65.cmd

Path C:\Users\Admin\AppData\Local\Temp\CXYGEB65.cmd
Size 8KB
SHA256 feb8d8591a5ebfdac240e0cac3d5c3503c8674830f5976daf5b5c1c686681dd3
MD5 48f474a6f5a23e2ef6fdd5fd07e1cf65
SHA1 c81a9ad89d5e8567c9fcda6ea70ae8ab5dd64525
SHA512 41319a5fbdd40f4e224dc772b1ab702b2feb42526fe543362dd8a1e3eed6a2ecef1f9804ccb9cbeb33bbed2f70ff6659861939ac841a2a94339c6df16310a397
SSDEEP 96:o6wGXEg0LTL+SyQ7nOYdOgdJcijDij/GvwkBKqOhGQ9Gz8wc7nOYdOgdJcijDijx:oPGm7OYdOgrci3iTNke7OYdOgrci3i3N
TLSH
T15C020E1211EF82F2C807C57ABE38C49E856FE48592C8450292D63D1B64F750B893FBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-189-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3404-146-0x0000000000400000-0x00000000004A0000-memory.dmp

Download

memory/3512-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3512-188-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5616-159-0x00007FF7C15F0000-0x00007FF7C311E000-memory.dmp

Download