Malware Analysis Report

2025-08-10 20:05

Sample ID 250704-pb49dahk61
Target 2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner
SHA256 54a6787cd14f35878b8f641433b6afc2f36fe44ce03682c589dc524fbf422748
Tags
defense_evasion discovery persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

54a6787cd14f35878b8f641433b6afc2f36fe44ce03682c589dc524fbf422748

Threat Level: Known bad

The file 2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery persistence spyware stealer trojan

Modifies visiblity of hidden/system files in Explorer

Windows security bypass

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Executes dropped EXE

Windows security modification

Checks computer location settings

Enumerates connected drives

Adds Run key to start application

Modifies WinLogon

Drops file in System32 directory

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-04 12:10

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-04 12:10

Reported

2025-07-04 12:12

Platform

win10v2004-20250619-en

Max time kernel

150s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe"

Signatures

Modifies visibility of file extensions in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Disables RegEdit via registry modification

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zykolegr = "advbjfyjjgedrdx.exe" C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wypvdpnasyjze.exe" C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jkfsgorx = "zrwfsugrvu.exe" C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\k: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\pxypyxpv.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created C:\Windows\SysWOW64\zrwfsugrvu.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\advbjfyjjgedrdx.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\advbjfyjjgedrdx.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\pxypyxpv.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\pxypyxpv.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\wypvdpnasyjze.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Windows\SysWOW64\zrwfsugrvu.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\wypvdpnasyjze.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\pxypyxpv.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\pxypyxpv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\pxypyxpv.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FAB0FE6BF1E0837A3B4781EB39E2B0FC02884314033DE2CC429D09A2" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7806BC5FE1D22DBD20ED0A18B7B9062" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4144907350-1836498122-2806216936-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32302D7A9D5583596D3F77D570212DDC7CF165DC" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB05B44E738E252BEB9A133EED4B9" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFC8E4F5B8268913CD65C7DE2BD97E631583767366234D791" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "194AC7781596DAB4B8C87CE1EDE037CB" C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\zrwfsugrvu.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\zrwfsugrvu.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\wypvdpnasyjze.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\advbjfyjjgedrdx.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A
N/A N/A C:\Windows\SysWOW64\pxypyxpv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3596 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\zrwfsugrvu.exe
PID 3596 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\zrwfsugrvu.exe
PID 3596 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\zrwfsugrvu.exe
PID 3596 wrote to memory of 5240 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\advbjfyjjgedrdx.exe
PID 3596 wrote to memory of 5240 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\advbjfyjjgedrdx.exe
PID 3596 wrote to memory of 5240 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\advbjfyjjgedrdx.exe
PID 3596 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\pxypyxpv.exe
PID 3596 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\pxypyxpv.exe
PID 3596 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\pxypyxpv.exe
PID 3596 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\wypvdpnasyjze.exe
PID 3596 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\wypvdpnasyjze.exe
PID 3596 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Windows\SysWOW64\wypvdpnasyjze.exe
PID 3596 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 3596 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 4216 wrote to memory of 4796 N/A C:\Windows\SysWOW64\zrwfsugrvu.exe C:\Windows\SysWOW64\pxypyxpv.exe
PID 4216 wrote to memory of 4796 N/A C:\Windows\SysWOW64\zrwfsugrvu.exe C:\Windows\SysWOW64\pxypyxpv.exe
PID 4216 wrote to memory of 4796 N/A C:\Windows\SysWOW64\zrwfsugrvu.exe C:\Windows\SysWOW64\pxypyxpv.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_e4f2b20c2d84e8ef419ab9ba32fb83f1_elex_stop_yuner.exe"

C:\Windows\SysWOW64\zrwfsugrvu.exe

zrwfsugrvu.exe

C:\Windows\SysWOW64\advbjfyjjgedrdx.exe

advbjfyjjgedrdx.exe

C:\Windows\SysWOW64\pxypyxpv.exe

pxypyxpv.exe

C:\Windows\SysWOW64\wypvdpnasyjze.exe

wypvdpnasyjze.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\SysWOW64\pxypyxpv.exe

C:\Windows\system32\pxypyxpv.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c advbjfyjjgedrdx.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c zrwfsugrvu.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wypvdpnasyjze.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 2.19.248.219:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.136:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp

Files

memory/3596-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\pxypyxpv.exe

MD5 25166a3fb4cdc1e4f9826f60438b52ef
SHA1 33b73eca3d08d00661e47c2d9367a4a222757a74
SHA256 7a243e8fdb2aed13629eb9b6cbf9e123584a83dde92e828050dcc621a7e9dfe5
SHA512 6ba7bdd1861d4cbdfff4d2bd6db9149208731ee7cceb4a015ad428e7e55dcc5097ab2dc566df489aa83d3a30b1d1aa9b313f19d78956d6b5bc4f01239fe89bc0

C:\Windows\SysWOW64\zrwfsugrvu.exe

MD5 95bbf8240179fe090a4502665e226b2a
SHA1 7884d54342c22b0fd6bb82053d4f5741ab79b103
SHA256 c00f67f83167b1be6e872db7aa19d26f93ac1eda58e79b7cfa1007bbe02c550f
SHA512 b5e58f49c2c6e397ebe6d0cbd7b82135a4805e34bb77f1d5540bc3445f9e88e4021b84f3ed28bc133263477d99a0fe39ec69e44a79d23160b1ba797458d1b5a9

C:\Windows\SysWOW64\advbjfyjjgedrdx.exe

MD5 60ebd55d0ebb38713d9212ca01544b23
SHA1 2ab5d99029fa52d78117a6cf2a95afcc85ed431a
SHA256 36be67bbd74ac3cf148cc6d776c1bbe3dfdfc584e40104b3a09b575d3f3a8a8d
SHA512 7d1cf4275909c4491137706936a0320c4b8039a78d64b82d3ec96b13b7e65f6f7e8280daae2d23eeec3bb6ec0b1481ea191ac0e304b761d0a4baf24c0c65f054

C:\Windows\SysWOW64\wypvdpnasyjze.exe

MD5 c13bac1b087fab658456b1ff7dd5540f
SHA1 52cf0af389aa6845d5f615e0cb0c80d4729c5095
SHA256 d477fe329b7f96238b9df8e101ab493bcebc2a31197303e22cf9f1099d577829
SHA512 6d7a0829c906a0b46371cb254fdc74d1ce898d2e06bb0b18e1561eb0f45bd9949534f343c50ef162690c94eec1f25424cc03b22a37737426a5dfa78c2ff579d8

memory/3584-35-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-36-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-37-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-38-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-39-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-42-0x00007FF9980F0000-0x00007FF998100000-memory.dmp

memory/3584-43-0x00007FF9980F0000-0x00007FF998100000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 dea103b4fc24ce3df9ea6f828dfba54d
SHA1 d86716a534165c234af6f265b9bea0f41008535a
SHA256 67a453d4eb3a30cbdd441f09685f645c7ed2389ab81a3306dd8592bb5b8a9ef3
SHA512 a8f64f454eba7fa6c4e60de61a39c8ac73423c453c6009323abc331cc17a53b0a67f61fb50d3663d9eacfa7b69e73d4fedb0dee83dbee8fcc06d6afd7e193c42

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 87a9c39c2cad3ab22f0b90f621ba117f
SHA1 960bf6861950ae3d84a46f5adb35ffd44ecee47f
SHA256 f49fcf3c2f247c45e934604792f156d96bbd40fdfeaad0ad5ca62b26fc06e19d
SHA512 a62461d1ccd48f55ac34d747ef7d4f38524f98b9710484c27888a6f112f41f663764f47fb190df0f08ee9e5ea80a3c817b5512c507e48197491b486201cd998c

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 bf3eef4d7de105407b87c7a7ecb4f9ee
SHA1 73a67d5d7631b61b3a828c565dddf81b18e1ccd6
SHA256 ebff9c09ce4d18fb3aa013f3183d73092600c98a4bce842e4e3e36abc2356e19
SHA512 7b88bcca01f70fafecac2a4ab6215e78371d433d16115b151684c877913ab506c0bfcdc975a5850da774c96d995dea90bd3d64d66ae4f42bba0971bf7952e92f

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

\??\c:\Users\Admin\Downloads\PushWrite.doc.exe

MD5 e00232dd9685fcd0685e63f2f30b56b9
SHA1 c8dedc8ef41294ab68217a79815d5fd2fb9bc83d
SHA256 b35f40a7d6e395bb84f8fa3e487ec7c833badcdc78a3f080255afd9554d5ff12
SHA512 94ddc2647f335f6e210a3f3ed5b9f5dfc87550ddc3852fb85b6271cde75b13a9b24e5ccdee143321312721450269238e50b6e501f8fc3a128a4f6ba87056b1c5

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 9f25e5a5e5f7aed915916464012e259b
SHA1 a82a7816a7548140eebfc2a3969643be1fbd303b
SHA256 6b251cb2ca19d6ef7e31f9080228cdeb2fe1e3c597da36108ae7b4a74dfc528a
SHA512 c695001e72a2fbe4a83a8fa04efaa7a7af672829af4e6aaec5f527a9362cdefe170a465ec9c3465074858873ed9bb72c272e7c449e5703b0f8beef62b617c145

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 a49b971123c7d7e5fb3a81a676b99954
SHA1 04bfeca353a6f13b4fe4cd80fdee72fa104d4d96
SHA256 f28cbead27d2ed3c1190d1137e12a22a48894bfbad13275f26bce0f6b11fe350
SHA512 c39c257728d440ac9416fafd172be19617d1a4216b9b539b52cc3cfaf11966602ca76ab1df10ee1bbec6e4ed8ae843318ad71cdb01e977d7e2308547c061834e

C:\Users\Admin\AppData\Local\Temp\TCDE7EF.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 f0365909ca425d2cf1f21868a55f06af
SHA1 0107bf117703172e5a955d5930b56bd66c7e0544
SHA256 45c90907a5a3db230bf007c1dbb6259176f806697a50ba19b9902c612c58cb83
SHA512 a5369828f87ab4355631df08fcad105dc76fe79f45c02c076c6c4a2fa3144249d2777f3f4f5ed0c5c669b6f9cdca3473bce742fd9bb9f04ed43b3c6b7a9c36c0

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

MD5 e98b5a0702f1b4beabdf19bb2a03ad58
SHA1 fb0088c1c4883b29031f66e6036b42bf7f08bdf7
SHA256 13ecaf099001e1eb9d7661db200fe75fa282fca8085e1c88ca84e1e232d911b0
SHA512 59e88c17f704c44d41df50f05ab52ef1a24ca1c2abef1d96541e2690e4a3eedbca8bca895c7d76768c76399dcb7f9aa2bc01b4f12a36ecd9a3878121ff6bb74a

memory/3584-618-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-617-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-620-0x00007FF99A650000-0x00007FF99A660000-memory.dmp

memory/3584-619-0x00007FF99A650000-0x00007FF99A660000-memory.dmp