Malware Analysis Report

2025-08-10 20:05

Sample ID 250704-pd3hkahl3t
Target 2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner
SHA256 187b12e76b28d6c706cd833dccd0ac2a284fc21d3e892e950c3595e5803e82e5
Tags
defense_evasion discovery persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

187b12e76b28d6c706cd833dccd0ac2a284fc21d3e892e950c3595e5803e82e5

Threat Level: Known bad

The file 2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner was found to be: Known bad.

Malicious Activity Summary

defense_evasion discovery persistence spyware stealer trojan

Windows security bypass

Modifies visiblity of hidden/system files in Explorer

Modifies visibility of file extensions in Explorer

Disables RegEdit via registry modification

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Checks computer location settings

Modifies WinLogon

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

AutoIT Executable

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-04 12:13

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-04 12:13

Reported

2025-07-04 12:16

Platform

win10v2004-20250610-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe"

Signatures

Modifies visibility of file extensions in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Modifies visiblity of hidden/system files in Explorer

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Disables RegEdit via registry modification

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbsjcwbk = "hahskjdzwb.exe" C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\micrrcgk = "srhbqidzphxrnge.exe" C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gojgtnjakxrpm.exe" C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\x: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\e: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\j: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\x: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\u: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\h: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\r: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\l: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\a: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\q: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\s: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\i: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\k: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\w: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\b: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\p: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\t: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\g: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\o: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\y: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\n: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\z: C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened (read-only) \??\m: C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File opened (read-only) \??\v: C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" C:\Windows\SysWOW64\hahskjdzwb.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\hahskjdzwb.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\srhbqidzphxrnge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\benbqdxb.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\benbqdxb.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\gojgtnjakxrpm.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\gojgtnjakxrpm.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File opened for modification C:\Windows\SysWOW64\msvbvm60.dll C:\Windows\SysWOW64\hahskjdzwb.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created C:\Windows\SysWOW64\hahskjdzwb.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File created C:\Windows\SysWOW64\srhbqidzphxrnge.exe C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe C:\Windows\SysWOW64\benbqdxb.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification C:\Windows\mydoc.rtf C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created C:\Windows\~$mydoc.rtf C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A
File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe C:\Windows\SysWOW64\benbqdxb.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\benbqdxb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\benbqdxb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\hahskjdzwb.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB7FF6721A9D273D1A98A7B9161" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184DC67815E1DBC0B9BD7CE7EDE034BB" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C799C2182256A3776A170222DAD7CF264DB" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B12F47E0399952CFBAD6339DD7C4" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFF88482A856F903CD7297DE6BD97E14658306645623ED799" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg C:\Windows\SysWOW64\hahskjdzwb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDF9CDF965F1E0840E3B31869F3EE2B38F02FC4260023BE1BF42E708D6" C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\hahskjdzwb.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\gojgtnjakxrpm.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\srhbqidzphxrnge.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A
N/A N/A C:\Windows\SysWOW64\benbqdxb.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1508 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\hahskjdzwb.exe
PID 1508 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\hahskjdzwb.exe
PID 1508 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\hahskjdzwb.exe
PID 1508 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\srhbqidzphxrnge.exe
PID 1508 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\srhbqidzphxrnge.exe
PID 1508 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\srhbqidzphxrnge.exe
PID 1508 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\benbqdxb.exe
PID 1508 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\benbqdxb.exe
PID 1508 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\benbqdxb.exe
PID 1508 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\gojgtnjakxrpm.exe
PID 1508 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\gojgtnjakxrpm.exe
PID 1508 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Windows\SysWOW64\gojgtnjakxrpm.exe
PID 1508 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1508 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
PID 1588 wrote to memory of 4724 N/A C:\Windows\SysWOW64\hahskjdzwb.exe C:\Windows\SysWOW64\benbqdxb.exe
PID 1588 wrote to memory of 4724 N/A C:\Windows\SysWOW64\hahskjdzwb.exe C:\Windows\SysWOW64\benbqdxb.exe
PID 1588 wrote to memory of 4724 N/A C:\Windows\SysWOW64\hahskjdzwb.exe C:\Windows\SysWOW64\benbqdxb.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe

"C:\Users\Admin\AppData\Local\Temp\2025-07-04_cb4339057f37835db60db37e0723661c_elex_stop_yuner.exe"

C:\Windows\SysWOW64\hahskjdzwb.exe

hahskjdzwb.exe

C:\Windows\SysWOW64\srhbqidzphxrnge.exe

srhbqidzphxrnge.exe

C:\Windows\SysWOW64\benbqdxb.exe

benbqdxb.exe

C:\Windows\SysWOW64\gojgtnjakxrpm.exe

gojgtnjakxrpm.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c hahskjdzwb.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c srhbqidzphxrnge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c gojgtnjakxrpm.exe

C:\Windows\SysWOW64\benbqdxb.exe

C:\Windows\system32\benbqdxb.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 2.19.248.219:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp

Files

memory/1508-0-0x0000000000400000-0x0000000000496000-memory.dmp

C:\Windows\SysWOW64\srhbqidzphxrnge.exe

MD5 bfdd05e3e30de711a0e6a53a4c4fa57c
SHA1 1f7939530960d821db1b25fb8a6bf8218c87395d
SHA256 5f4546864d0c9788f57502316bbbc4e4c0d58cbcc4e9c613c464d63659e17e3c
SHA512 022ad307a4d84e67048ef1efc4683403f10a9127d3e90926144ff0ea5d18aba0daeb8c0445ac4232d23d0d68e8c9401a08d27ba61e1de08d2e6ec418ccc0ee77

C:\Windows\SysWOW64\hahskjdzwb.exe

MD5 44cd7b8ba24e967a8ddf820d8104b0f1
SHA1 2a901482118893ed40d2923809af8245fb9853c0
SHA256 8a129f0bc39a131ad6d7ca89a54218bc8649983548b46dbc9a3d4ab39fb1ebd0
SHA512 eea01b9e027469d178726a1b6f1d12528c7482769b1bf179c0f421d7e85a946806a5f1b8f779db61841ab553c11d90208c018455bca2d9c0a3e078343ca344bf

C:\Windows\SysWOW64\benbqdxb.exe

MD5 056b2df0bc8a854869800e9be5198870
SHA1 2da716acaa3d79598f4382bb5a15e609ebb41ae1
SHA256 a4d47b55915381ab5caf05c41f7be607b86e9099123569fc8ee06656e24cf780
SHA512 0779713a0de04ce0cf927ebc9ffc93791f71159ca916f64569c035184b49ea854ef6725b2472e1f91decfc4c37033a1b48ac5eedc29676e469fba94778c52dcf

C:\Windows\SysWOW64\gojgtnjakxrpm.exe

MD5 da72332f0c19362fa643e25a2b9fdcb3
SHA1 0866754e780707c92cab21ee6853424f6452b8e7
SHA256 a5012d514f1697745c729a8454b09beab6f426e9cb67c86a3ced7b6d90839fce
SHA512 a86772698ec80784ab4bcf35d91bcad8b5cfac4302d2656e4f7a58acbb242936b2901a8c3cbc4f6e32cbbea41258233aa7ec91e8d5a1b1527e1721f96713ec71

memory/5716-39-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-38-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-40-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-37-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-41-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-42-0x00007FFC22380000-0x00007FFC22390000-memory.dmp

memory/5716-43-0x00007FFC22380000-0x00007FFC22390000-memory.dmp

C:\Windows\mydoc.rtf

MD5 06604e5941c126e2e7be02c5cd9f62ec
SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 fed9010112e641295f358cbf2b793a96
SHA1 0144ae4751bdba4aad32148c024a3597601525ae
SHA256 38a70abe1a4c96a41948dfa670d01c46eb131284c87199920b22736c21f531e5
SHA512 7f3796b7fe6400d3324092a7e66365d397eb1a32514e35a0e3cf2f38029f96c89b566efdccf0636d7bbe6b6c3ae2ae21285ea5fd6747d927de64dbd39a386a16

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

MD5 8bc9ce20a892b52912f073225133e47d
SHA1 95a84c41456625eaa6769496b8ec3b2502b2e45f
SHA256 ebc0119d367f832a8db4a89c815beea8d66650d7b150b28d55daaf22576edf17
SHA512 1d309c1b13ef309f5784d031650d93534220c39d4c4fe23446954a1605161e6cfa1487104b14f2828e7e637891f5d6152abd5d731cf2dd2a502171576a8db78a

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

MD5 6aaaa73bcdf7d0206a8b6648c493afeb
SHA1 f4b46dea77119ad410c3a8a0f5f893810e7e8f36
SHA256 716cabd3fce3bd2c1b16a44529e0eb41127562108caee6dc1d1974eacd45a9f0
SHA512 16e58f3820155b242069430bb4f4b5b72b79580f4718c886a9490210b678739578f267c9737501c10ff4bee254bff31f4fbdab992280c7d50a11dee2adbe11bf

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

MD5 d29962abc88624befc0135579ae485ec
SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

C:\Users\Admin\Downloads\PopRepair.doc.exe

MD5 19d8e04ddfb4a7aa8ea63afaf7f79e06
SHA1 6e93513a7839464d044086e265df773608c65276
SHA256 1e1d23d3f56698088c2a0c8913a46d9fb53018fc3b0899099e89c7cf181f65f3
SHA512 bd08d08a0eafe611e7cca9a283d2001eaea6b3cb0f7048678891450df5b3c1817a837242a8a389cb11d8576d169910885b89ad38fb29864d75fff43bb97de5df

\??\c:\Users\Admin\Desktop\ConfirmReset.doc.exe

MD5 f441a68ad26fd8ad4dad050f3ed18c1a
SHA1 fea19feb4648b52cdf628298121cdc6f56782f9c
SHA256 12960947ae2a769c5684f8ad11b0910ce5b917f311d8ca98f607d72c600dbedd
SHA512 0b68ef8b0af950e54b58c52f07966c9948295f82fad455ab2bba1051efd502094fa791fc26c2e1c6271de349298f73956ccbfd06478b4a84f520f0fc2ef24cbf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 ef76364b7ae7766287587f2e4be9fba6
SHA1 bc8453e008ddd2ebc7b910c3079732f96cdb5d45
SHA256 6f026fbdf1e196cdf4a7bb3d041eafc0c2e50d49083fd33ef8f95c93d2ded389
SHA512 3ced87a6dd5aeb9cdea60075f98afcb594524bcc17e0ae3d9809b4ce3dae2b490b2796aff2fc01e696a70735fc8d2817d3e66370e079f3f84717378e07bf9765

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 6372b423309cde1c3a913e77833a33c6
SHA1 25fa14b9b30133137d908aafb6d52dea4bb005ec
SHA256 4718d4976171341b22ea4df646a503ed50d8748aef7f37fe6331aef9dc8f763d
SHA512 3acf2051969e6c3670d05bd03d284d3f909d416830a2068be7d8e9df9d0d26041a48479333c47faff970e96f7e79e182442f1aa023b66d66ee4af8f538857262

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 4ba130c948842e117aed9bff02163fbe
SHA1 ca5742b9388dcfdc796da425d2469884d02f7e59
SHA256 8bd30ab352b34ad2e0e840b35a7559b912b8aff9f0a4b0a7bc600fa2d14a3664
SHA512 1ce9ab9ff645229b8bc7e828a78fbd5331df9974a4ba956b6f1eae24e761a2b28eaa96beb70c2efa8e765a80410e059beb221bb8fdd42f3a7676df1f8cf13ab9

C:\Users\Admin\AppData\Local\Temp\TCDA39D.tmp\sist02.xsl

MD5 f883b260a8d67082ea895c14bf56dd56
SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

MD5 807ae0f47448f1c7ffb90dcf7a3c67a5
SHA1 ca0f2237f1e38aabc5048f523d453da29cade224
SHA256 33303182d446da2e3e5263337ba4d9af680d5eccf6efff1700b5343dfbc258e3
SHA512 1874d1380611dfcd82abcc81e12f6ecf3a14536a239eacab63fb0f8c95d497486cc123641561776f3989d669a6d022664366bf88cebacd1dd73276da860e3fc3

memory/5716-614-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-612-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-613-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp

memory/5716-611-0x00007FFC244F0000-0x00007FFC24500000-memory.dmp