Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 03:05
Behavioral task
behavioral1
Sample
2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
- Size 512KB
- Sample260425-dlln8sdy21
- SHA256 b8e10ca4de61e5e8939cf3fa67a9f612829fe854987377b5fa1197b259ff8998
- MD5 b6df13aeaf8595a97872555a95a13768
- SHA1 5aaf8be0539eb0ea8a3c455d46c02ae59b06aff6
- SHA512 22f126bbbc043f48779a9b78444f9a7021527c516d59c3d7aea74c224a27bb51bd2c0a1d005be9c3ab8fe583da5d9d82c4ddede391d00ddd2ee9f0805a5597f4
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- TLSH T131B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 10 IoCs
resource yara_rule behavioral2/files/0x001a00000002b3ff-5.dat family_sohanad behavioral2/files/0x001f00000002b300-18.dat family_sohanad behavioral2/files/0x001600000002b401-32.dat family_sohanad behavioral2/files/0x001900000002b400-29.dat family_sohanad behavioral2/files/0x001900000002b40c-60.dat family_sohanad behavioral2/files/0x001900000002b40d-65.dat family_sohanad behavioral2/files/0x001900000002b40f-71.dat family_sohanad behavioral2/files/0x001900000002b410-74.dat family_sohanad behavioral2/files/0x000b000000024e0b-504.dat family_sohanad behavioral2/files/0x000b000000024e0b-510.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wenhrinsjo.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wenhrinsjo.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wenhrinsjo.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wenhrinsjo.exe - Executes dropped EXE 5 IoCs
pid Process 3284 wenhrinsjo.exe 2996 sxixvyykgkbmpce.exe 2712 mqbpiubf.exe 4012 nqhgnkqcvwxqd.exe 428 mqbpiubf.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wenhrinsjo.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\twudzwpx = "wenhrinsjo.exe" sxixvyykgkbmpce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ktcqofyx = "sxixvyykgkbmpce.exe" sxixvyykgkbmpce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nqhgnkqcvwxqd.exe" sxixvyykgkbmpce.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: mqbpiubf.exe File opened (read-only) \??\t: mqbpiubf.exe File opened (read-only) \??\r: mqbpiubf.exe File opened (read-only) \??\y: mqbpiubf.exe File opened (read-only) \??\r: mqbpiubf.exe File opened (read-only) \??\e: wenhrinsjo.exe File opened (read-only) \??\l: mqbpiubf.exe File opened (read-only) \??\p: mqbpiubf.exe File opened (read-only) \??\z: mqbpiubf.exe File opened (read-only) \??\z: mqbpiubf.exe File opened (read-only) \??\w: wenhrinsjo.exe File opened (read-only) \??\a: mqbpiubf.exe File opened (read-only) \??\h: mqbpiubf.exe File opened (read-only) \??\x: mqbpiubf.exe File opened (read-only) \??\n: mqbpiubf.exe File opened (read-only) \??\u: mqbpiubf.exe File opened (read-only) \??\h: wenhrinsjo.exe File opened (read-only) \??\l: wenhrinsjo.exe File opened (read-only) \??\z: wenhrinsjo.exe File opened (read-only) \??\e: mqbpiubf.exe File opened (read-only) \??\p: mqbpiubf.exe File opened (read-only) \??\i: mqbpiubf.exe File opened (read-only) \??\b: wenhrinsjo.exe File opened (read-only) \??\k: wenhrinsjo.exe File opened (read-only) \??\h: mqbpiubf.exe File opened (read-only) \??\a: wenhrinsjo.exe File opened (read-only) \??\u: wenhrinsjo.exe File opened (read-only) \??\x: wenhrinsjo.exe File opened (read-only) \??\b: mqbpiubf.exe File opened (read-only) \??\l: mqbpiubf.exe File opened (read-only) \??\s: mqbpiubf.exe File opened (read-only) \??\v: mqbpiubf.exe File opened (read-only) \??\o: wenhrinsjo.exe File opened (read-only) \??\q: wenhrinsjo.exe File opened (read-only) \??\i: mqbpiubf.exe File opened (read-only) \??\j: mqbpiubf.exe File opened (read-only) \??\k: mqbpiubf.exe File opened (read-only) \??\q: mqbpiubf.exe File opened (read-only) \??\e: mqbpiubf.exe File opened (read-only) \??\o: mqbpiubf.exe File opened (read-only) \??\n: wenhrinsjo.exe File opened (read-only) \??\s: mqbpiubf.exe File opened (read-only) \??\v: mqbpiubf.exe File opened (read-only) \??\m: mqbpiubf.exe File opened (read-only) \??\y: mqbpiubf.exe File opened (read-only) \??\r: wenhrinsjo.exe File opened (read-only) \??\m: mqbpiubf.exe File opened (read-only) \??\a: mqbpiubf.exe File opened (read-only) \??\g: mqbpiubf.exe File opened (read-only) \??\g: wenhrinsjo.exe File opened (read-only) \??\p: wenhrinsjo.exe File opened (read-only) \??\s: wenhrinsjo.exe File opened (read-only) \??\o: mqbpiubf.exe File opened (read-only) \??\u: mqbpiubf.exe File opened (read-only) \??\k: mqbpiubf.exe File opened (read-only) \??\w: mqbpiubf.exe File opened (read-only) \??\m: wenhrinsjo.exe File opened (read-only) \??\t: mqbpiubf.exe File opened (read-only) \??\w: mqbpiubf.exe File opened (read-only) \??\b: mqbpiubf.exe File opened (read-only) \??\i: wenhrinsjo.exe File opened (read-only) \??\v: wenhrinsjo.exe File opened (read-only) \??\g: mqbpiubf.exe File opened (read-only) \??\q: mqbpiubf.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wenhrinsjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wenhrinsjo.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3684-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001a00000002b3ff-5.dat autoit_exe behavioral2/files/0x001f00000002b300-18.dat autoit_exe behavioral2/files/0x001600000002b401-32.dat autoit_exe behavioral2/files/0x001900000002b400-29.dat autoit_exe behavioral2/files/0x001900000002b40c-60.dat autoit_exe behavioral2/files/0x001900000002b40d-65.dat autoit_exe behavioral2/files/0x001900000002b40f-71.dat autoit_exe behavioral2/files/0x001900000002b410-74.dat autoit_exe behavioral2/files/0x000b000000024e0b-504.dat autoit_exe behavioral2/files/0x000b000000024e0b-510.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wenhrinsjo.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mqbpiubf.exe File created C:\Windows\SysWOW64\wenhrinsjo.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\nqhgnkqcvwxqd.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification C:\Windows\SysWOW64\wenhrinsjo.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\SysWOW64\sxixvyykgkbmpce.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\sxixvyykgkbmpce.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\SysWOW64\mqbpiubf.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\mqbpiubf.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\SysWOW64\nqhgnkqcvwxqd.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mqbpiubf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mqbpiubf.exe File opened for modification C:\Program Files\UseFormat.nal mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mqbpiubf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mqbpiubf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mqbpiubf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mqbpiubf.exe File opened for modification \??\c:\Program Files\UseFormat.doc.exe mqbpiubf.exe File opened for modification C:\Program Files\UseFormat.doc.exe mqbpiubf.exe File opened for modification C:\Program Files\UseFormat.nal mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mqbpiubf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mqbpiubf.exe File opened for modification \??\c:\Program Files\UseFormat.doc.exe mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mqbpiubf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mqbpiubf.exe File created \??\c:\Program Files\UseFormat.doc.exe mqbpiubf.exe File opened for modification C:\Program Files\UseFormat.doc.exe mqbpiubf.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe mqbpiubf.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe mqbpiubf.exe File opened for modification C:\Windows\mydoc.rtf 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe mqbpiubf.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mqbpiubf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wenhrinsjo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sxixvyykgkbmpce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mqbpiubf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nqhgnkqcvwxqd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wenhrinsjo.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wenhrinsjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C7D9C2783576D3E76A070512DDD7D8464D6" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC77515E1DBC5B8CB7CE2EC9737BA" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B02B479738E253BEB9D732E8D7B9" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wenhrinsjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDF9BCF964F291840F3A3181EB39E1B08802FF4311034FE2CE429C08D6" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFCF94828856F9136D72C7E94BDEEE6345840664F623FD790" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F568B2FF1821DCD17AD1A98B799062" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wenhrinsjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wenhrinsjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wenhrinsjo.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 844 WINWORD.EXE 844 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 4012 nqhgnkqcvwxqd.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 4012 nqhgnkqcvwxqd.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 428 mqbpiubf.exe 428 mqbpiubf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 428 mqbpiubf.exe 428 mqbpiubf.exe 428 mqbpiubf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 3284 wenhrinsjo.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 2996 sxixvyykgkbmpce.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 4012 nqhgnkqcvwxqd.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 2712 mqbpiubf.exe 428 mqbpiubf.exe 428 mqbpiubf.exe 428 mqbpiubf.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE 844 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3684 wrote to memory of 3284 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 79 PID 3684 wrote to memory of 2996 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 80 PID 3684 wrote to memory of 2712 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 81 PID 3684 wrote to memory of 4012 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 82 PID 3684 wrote to memory of 844 3684 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 83 PID 3284 wrote to memory of 428 3284 wenhrinsjo.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\wenhrinsjo.exewenhrinsjo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\mqbpiubf.exeC:\Windows\system32\mqbpiubf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:428
-
-
-
C:\Windows\SysWOW64\sxixvyykgkbmpce.exesxixvyykgkbmpce.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2996
-
-
C:\Windows\SysWOW64\mqbpiubf.exemqbpiubf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712
-
-
C:\Windows\SysWOW64\nqhgnkqcvwxqd.exenqhgnkqcvwxqd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4012
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:844
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 61c45f40a01edcaad14b523841a7bd7809ceafa7c7241dadb402bcf5dd6effb3
- MD5 7b14d6454d368275a917b93480830b2f
- SHA1 b73ebbc6a8d1d2fa12dbddce6e72c1d3aedd3d60
- SHA512 8094aeb213cfe29556ad458a9da2d64f89fc313b25f8dcb87ebb684037bb9c85eafdcef706a5fc8fe2aeab4b015444d58bbeb841585760f3e125e105ace84f70
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T15CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\UseFormat.doc.exe
- Size 512KB
- SHA256 7eff91b4aec4aeab5bb43c2346c27692544fd397491976b1055a1dad8eb7c354
- MD5 66bb3f87c87f94e3bbb8cf21de6c4c27
- SHA1 96d90c6497982f49f57db4347b428e70c69dc720
- SHA512 1985da47e1cc52428e97df8c26097f6e5856e8687b5ad6923bc4feab90b42f0ff9bbb3e080057b070bdc8746161ca09ecfe710568dcdb9f1efeb6d19fcc78ba2
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- TLSH T117B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDB611.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 285B
- SHA256 930b8972a96a62c8bf3a041dfb53cd1b61c37a4f55ba3d3516bc7b3b68fc4b81
- MD5 907e1dd3747f8b1475ba40f1560a96fa
- SHA1 e1ae9c57c32776da305a38a45195f67ca863490b
- SHA512 2245d3c79218d9554462ca84344e551c6fe9ba685789bfb5e3e010e7f9f09a7de2e386a62978bf5aa70ef704b7a55a8603255105b4d6d82729d98be9ba099055
- TLSH T1FED0679BB348E7F2433D015439795CD96BF78C94D2DDE02146CC0D452C60697106B999
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ad3f906d475b65c073e44c19031528f1cf1cc9c8f975a27e3c834d6b3f168e67
- MD5 d3dbaa0a8ce2b4468f469d4cd66bfb95
- SHA1 dbf03b4205eecaffdacfb967ca854435a3d6314a
- SHA512 b8baa7433e88ec592be6231eb6949a31b05d759fb7a6cf2ad10d2e19a81d66175c484b9b6f093cb4c7af6675f7dd1d6a0c6d5a2c5441c361e80ec39ecbee0b37
- TLSH T1976156120797AF17E0114136122EA349EB707D47F75CBA1D66C86E05DF309942B8CFAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 52bc6296b5347f969e2c23272ac2c721043020992aa173bd40c33de2e1065673
- MD5 1df4eb9cb8cebdca91f5053803616bcd
- SHA1 0ca5b561793438195d66903f3a0ccc13e5c1e39f
- SHA512 141114afe774b12ba2fbcedc2787088e9e8b1520de13fb4a49fb57f38d4feff525b2b281f7be8bf5691f6f7e778b8c3cd4f338ab8570a6b498a1d354b7889146
- TLSH T1E451331207D76F17E0510132122A9349E7703C4BE76CB60D6A886E099F319942B8CF9D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\PopLimit.doc.exe
- Size 512KB
- SHA256 c98f0635a7755fb07a96b73cf010afcc602f6bdb03ccfa3896ea34c6c9de9545
- MD5 5c7e8645b7605f8dba422fbccb80e517
- SHA1 fc738e1b4bef58761b25702751d03dae8229ed1e
- SHA512 05e9d477dce74eb8d0fa8a23418164abef3d6e8822e7ad07ab91be603b83e8b81dfdde945c73bdc3b776064ad64d058c85960132940cb971bfe4302f00377f43
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- TLSH T18FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mqbpiubf.exe
- Size 512KB
- SHA256 83bf0e47aae6b43aaf39d3b0368a02eca0590f45bf2cd436ea5537ebaf0be8fe
- MD5 b7fda968b617cce6a53189a108f75227
- SHA1 fb1c5f38649f2d4428ecb5b62ad9287f19e00e16
- SHA512 a1f6785ca9d85f7aa6291b4467e2915168d5466b5636f62d14bd6b32c06f30a3d63f314842a73f8c914cac43a3e42dc8a2fb961d6f638fee3db569c71fa1234a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- TLSH T172B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nqhgnkqcvwxqd.exe
- Size 512KB
- SHA256 af1634f54def3fbaa17ff24fba3ad1c6c488f7ea10eaea479ff6a3bbb4595e67
- MD5 94d47b72ca4aee3496ff83e7961c239b
- SHA1 60239d609d5158ff29a4647f13d328d0e69d4675
- SHA512 3fc13747877cf4ca744263a9ed4cb6a30f2e29538d9ba4cb64aa8e2fc179a37964224b6e1872c3023833eebef4ab92ea23fb92fec6deb87f398b19414394f30e
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T1C3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\sxixvyykgkbmpce.exe
- Size 512KB
- SHA256 ef7a0b8bfadcd57a070ee11589b7773a360ec2eb549454a9d0ac51926627f401
- MD5 3175886ec06afa7ece6ac53a2f39b9d3
- SHA1 70be782afb1050f60ab674a0f9b9392b67f1bced
- SHA512 b8c0b63e1dd4d3d0dd10b8af953dbb704197c9678ae954461fd17aec3977b7eec5de0bd559ab73fd9688cf826a0b4b9c68074efe13f76e9e97ddd93f621f15ee
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- TLSH T1C1B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\wenhrinsjo.exe
- Size 512KB
- SHA256 5c30ef11a3383a434562b835c7818df587f795fe0f3dae91cdc636f9c4bb2698
- MD5 89bc9574491aafc2d16d2cce9e640a74
- SHA1 9a6f7d92c3419edfa5b94d9256830df86f52299b
- SHA512 bfbff9eeb55417450d375345aac8678382a306222263b5cd90d2dd4e911c3964c01c37c034662be431b886d9e574418a6f4a10b984fef651150d067809bdf6fb
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- TLSH T14BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 8e4667ba9f8df1c50770ecda746f8f2718c589f9c4b284509feb7e1fef09bdef
- MD5 d587718db187e1911d5ec89964acbafe
- SHA1 2c6c6e4e0edc20e40d4b52f8782360b0a9ef7339
- SHA512 8314b2a1787764f8f7011158209231655c2c09fecce484d4519264b944e0b267c0fba08aa43277070f4b64e64d60c45808b4122b3c2e39aaf03cd59e6b7749d9
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
- TLSH T17BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 a38d0dfa5c8ed9b403acc83a024743ec57b86cdc35b9409e3d64b0d7d9a39635
- MD5 36287d8001ef24117f5b369bb636f6f5
- SHA1 c5c2da3c442ac6fe22fa7402c5ab91cd2da0f7c4
- SHA512 c9d69faebdd4adc7c5600662996f4d6c7c84635d5f584fb1c06edd5e9e2e1bf14f9728b33cf1257ec665ec442d7a214d10a658b964d48567ad26850750e0afb3
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h
- TLSH T1B3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 bc83210b6191828e2dbad1c57dd817a8060cdc3a4096e6a8618f73d91b85f5ad
- MD5 07e00e04c1df458d8b3fd287c2a9e8fa
- SHA1 35cb88c2172236e0d298e909e3594ba480310d46
- SHA512 01057958b374c3d023a4c4fc8b1d4577804934bb2d759e217192660ee9fe72edfa13e002953450aaaf3be7c40850bcd2b15f9f10e654be143441fedeafc579e6
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- TLSH T15BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH