Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:09
Behavioral task
behavioral1
Sample
2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe
Resource
win11-20260513-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe
- Size 513KB
- Sample260604-sjpensht41
- SHA256 6952425185b4979499702d85919b94085f862eb8eeb2f91ea154184afbc92630
- MD5 f7daf9e5a787aea322e866affd8bc97b
- SHA1 461cc660e7d660cc8f0c847bfa7d876c991bdf40
- SHA512 2487b8b9080e588f4c1a70b81fddf51f06aeadc70098de2e968a18f189142f7d7cf0d732e8daceab4e7b6840f5b49d3dc180adcd79a1fffab9e4a4f89854a062
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T1A3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 11 IoCs
resource yara_rule behavioral2/files/0x002100000002b2d4-5.dat family_sohanad behavioral2/files/0x001d00000002b216-18.dat family_sohanad behavioral2/files/0x001900000002b394-32.dat family_sohanad behavioral2/files/0x001a00000002b393-29.dat family_sohanad behavioral2/files/0x001a00000002b183-56.dat family_sohanad behavioral2/files/0x001a00000002b184-59.dat family_sohanad behavioral2/files/0x000300000002a2d9-72.dat family_sohanad behavioral2/files/0x001900000002b3a8-78.dat family_sohanad behavioral2/files/0x001900000002b3a9-84.dat family_sohanad behavioral2/files/0x001f00000002b3bf-463.dat family_sohanad behavioral2/files/0x001f00000002b3bf-476.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" omhatbklyz.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" omhatbklyz.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" omhatbklyz.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" omhatbklyz.exe - Executes dropped EXE 5 IoCs
pid Process 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 844 nbbyacun.exe 3620 gqiqpntdtgthd.exe 3768 nbbyacun.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" omhatbklyz.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gqiqpntdtgthd.exe" zqbgpkptroitufe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cgkuaaue = "omhatbklyz.exe" zqbgpkptroitufe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nsmyzazz = "zqbgpkptroitufe.exe" zqbgpkptroitufe.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: nbbyacun.exe File opened (read-only) \??\h: omhatbklyz.exe File opened (read-only) \??\y: omhatbklyz.exe File opened (read-only) \??\j: nbbyacun.exe File opened (read-only) \??\m: nbbyacun.exe File opened (read-only) \??\k: nbbyacun.exe File opened (read-only) \??\m: nbbyacun.exe File opened (read-only) \??\b: omhatbklyz.exe File opened (read-only) \??\z: omhatbklyz.exe File opened (read-only) \??\g: nbbyacun.exe File opened (read-only) \??\u: nbbyacun.exe File opened (read-only) \??\r: omhatbklyz.exe File opened (read-only) \??\x: omhatbklyz.exe File opened (read-only) \??\p: omhatbklyz.exe File opened (read-only) \??\s: omhatbklyz.exe File opened (read-only) \??\v: nbbyacun.exe File opened (read-only) \??\i: nbbyacun.exe File opened (read-only) \??\o: nbbyacun.exe File opened (read-only) \??\g: omhatbklyz.exe File opened (read-only) \??\e: nbbyacun.exe File opened (read-only) \??\e: omhatbklyz.exe File opened (read-only) \??\t: omhatbklyz.exe File opened (read-only) \??\q: nbbyacun.exe File opened (read-only) \??\p: nbbyacun.exe File opened (read-only) \??\o: nbbyacun.exe File opened (read-only) \??\z: nbbyacun.exe File opened (read-only) \??\b: nbbyacun.exe File opened (read-only) \??\e: nbbyacun.exe File opened (read-only) \??\v: nbbyacun.exe File opened (read-only) \??\l: omhatbklyz.exe File opened (read-only) \??\v: omhatbklyz.exe File opened (read-only) \??\y: nbbyacun.exe File opened (read-only) \??\u: omhatbklyz.exe File opened (read-only) \??\w: nbbyacun.exe File opened (read-only) \??\m: omhatbklyz.exe File opened (read-only) \??\l: nbbyacun.exe File opened (read-only) \??\p: nbbyacun.exe File opened (read-only) \??\a: nbbyacun.exe File opened (read-only) \??\l: nbbyacun.exe File opened (read-only) \??\r: nbbyacun.exe File opened (read-only) \??\y: nbbyacun.exe File opened (read-only) \??\z: nbbyacun.exe File opened (read-only) \??\b: nbbyacun.exe File opened (read-only) \??\g: nbbyacun.exe File opened (read-only) \??\s: nbbyacun.exe File opened (read-only) \??\o: omhatbklyz.exe File opened (read-only) \??\q: omhatbklyz.exe File opened (read-only) \??\h: nbbyacun.exe File opened (read-only) \??\r: nbbyacun.exe File opened (read-only) \??\u: nbbyacun.exe File opened (read-only) \??\j: nbbyacun.exe File opened (read-only) \??\q: nbbyacun.exe File opened (read-only) \??\i: omhatbklyz.exe File opened (read-only) \??\j: omhatbklyz.exe File opened (read-only) \??\w: nbbyacun.exe File opened (read-only) \??\x: nbbyacun.exe File opened (read-only) \??\x: nbbyacun.exe File opened (read-only) \??\n: nbbyacun.exe File opened (read-only) \??\s: nbbyacun.exe File opened (read-only) \??\t: nbbyacun.exe File opened (read-only) \??\a: omhatbklyz.exe File opened (read-only) \??\k: omhatbklyz.exe File opened (read-only) \??\n: omhatbklyz.exe File opened (read-only) \??\i: nbbyacun.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" omhatbklyz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" omhatbklyz.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4076-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x002100000002b2d4-5.dat autoit_exe behavioral2/files/0x001d00000002b216-18.dat autoit_exe behavioral2/files/0x001900000002b394-32.dat autoit_exe behavioral2/files/0x001a00000002b393-29.dat autoit_exe behavioral2/files/0x001a00000002b183-56.dat autoit_exe behavioral2/files/0x001a00000002b184-59.dat autoit_exe behavioral2/files/0x000300000002a2d9-72.dat autoit_exe behavioral2/files/0x001900000002b3a8-78.dat autoit_exe behavioral2/files/0x001900000002b3a9-84.dat autoit_exe behavioral2/files/0x001f00000002b3bf-463.dat autoit_exe behavioral2/files/0x001f00000002b3bf-476.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nbbyacun.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nbbyacun.exe File created C:\Windows\SysWOW64\omhatbklyz.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\omhatbklyz.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\zqbgpkptroitufe.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\nbbyacun.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\gqiqpntdtgthd.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\gqiqpntdtgthd.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll omhatbklyz.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification C:\Windows\SysWOW64\zqbgpkptroitufe.exe 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nbbyacun.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal nbbyacun.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal nbbyacun.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal nbbyacun.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nbbyacun.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nbbyacun.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe nbbyacun.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe nbbyacun.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe nbbyacun.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe nbbyacun.exe File opened for modification C:\Windows\mydoc.rtf 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe nbbyacun.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe nbbyacun.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe nbbyacun.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language omhatbklyz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zqbgpkptroitufe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbyacun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gqiqpntdtgthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbyacun.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFCF9482982699047D7297E91BD90E636594066436336D790" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F26BB2FE6F22DDD208D0D68B7C9116" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" omhatbklyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372C0C9C2183276D4176D270562CAB7C8765AA" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" omhatbklyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9CCF916F1E784093B4A819B3E95B38D02FB4361023DE2CB42E608D6" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC70B1594DBB2B9CE7CE5EC9437BC" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" omhatbklyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh omhatbklyz.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf omhatbklyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B128479738EB53CFBAD133E9D7C8" 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5068 WINWORD.EXE 5068 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 4452 omhatbklyz.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 844 nbbyacun.exe 844 nbbyacun.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 844 nbbyacun.exe 844 nbbyacun.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 844 nbbyacun.exe 844 nbbyacun.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 844 nbbyacun.exe 844 nbbyacun.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 3936 zqbgpkptroitufe.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3768 nbbyacun.exe 3768 nbbyacun.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 844 nbbyacun.exe 844 nbbyacun.exe 844 nbbyacun.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3768 nbbyacun.exe 3768 nbbyacun.exe 3768 nbbyacun.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 844 nbbyacun.exe 844 nbbyacun.exe 844 nbbyacun.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 4452 omhatbklyz.exe 3936 zqbgpkptroitufe.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3620 gqiqpntdtgthd.exe 3768 nbbyacun.exe 3768 nbbyacun.exe 3768 nbbyacun.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE 5068 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4076 wrote to memory of 4452 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 80 PID 4076 wrote to memory of 3936 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 81 PID 4076 wrote to memory of 844 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 82 PID 4076 wrote to memory of 3620 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 83 PID 4076 wrote to memory of 5068 4076 2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe 84 PID 4452 wrote to memory of 3768 4452 omhatbklyz.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f7daf9e5a787aea322e866affd8bc97b_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\omhatbklyz.exeomhatbklyz.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\nbbyacun.exeC:\Windows\system32\nbbyacun.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3768
-
-
-
C:\Windows\SysWOW64\zqbgpkptroitufe.exezqbgpkptroitufe.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3936
-
-
C:\Windows\SysWOW64\nbbyacun.exenbbyacun.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844
-
-
C:\Windows\SysWOW64\gqiqpntdtgthd.exegqiqpntdtgthd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3620
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5068
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 513KB
- SHA256 cf30f288f64a61cf71ae14e23e6c011477d9dff77a308db2428d363a1d59ce84
- MD5 4b8fabc8ee345e149e7a1ed22be79d91
- SHA1 2b756fa6901ba92d23603c94ad5aaa2bcc3a4b52
- SHA512 f2f80521dc5f4bb2b0490f20a44dd038f1334a4c8bd857fcfcf7d39f41e2faf97f5c92e4410992cd7d2c1d151b1a418aaa137545075c078ef63d2e7c6a3d962b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T1C0B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 513KB
- SHA256 7a9d5a050394d1a0ec55c0cd3a81f18ecb5f699afb3f304c99052803020f11a2
- MD5 d90ef548ac66eb31adf3e7b1c2081456
- SHA1 8ecd8ed368f57ce691db4c7af698cc2f1a29f9fe
- SHA512 ccc666fcc64ffcaa4a5ba56d62174e50c28d6a16c1f5596fb073082c46c0cdc13224a0f93b4b88d15001ff26e1d405184fe58149135bdc38b8ede477b819c1d5
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- TLSH T1DDB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 2bd4f78559f2c5dc538f1e2e5f3080e8b5a56f91503d69dffa0b36c8848d473a
- MD5 4a733818c607409f881417855c3d4114
- SHA1 87a7d2c1cde1b92250a9799913412a5f8d7dda2f
- SHA512 180811686e423dfd3f747c5ec05f530b769065ab072d5a247b1b7d65456d931400804d27165d29321c36b82496f22d3ea22ba1cac51bf9389addedd696fbb123
- TLSH T14CE02E022FE80214F5730B3CAC736508A93BB33B6A42CACC0234008D0C21FA2CC3271D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD7268.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExitInitialize\SuspendLimit.doc.exe
- Size 513KB
- SHA256 1eaff11204cfe8e50b920a52e929a161db1b5448688da377313532148dad2bb6
- MD5 958851803b486964ef1ab1416b04a2cd
- SHA1 da2660ae66f0d4fb8634b01d184c935e8fbecc5a
- SHA512 5ff3c9c1ee4e00cd435ba9c5e2e152c08929ef6e55acb3855330425a820879020caa9a254c018aa7408c2994639ab198971912c80a9daefacce1d7d52e26cc69
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- TLSH T1FDB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 424B
- SHA256 07f7da2ab6236de1d70f53a26f459ada087afe4df43d36b75d446fa8fa4d64c1
- MD5 e25ada38293f0579c699c0aebb00a72d
- SHA1 63693242317408ea39cdd7344dc93e8acf0b427f
- SHA512 c805bc0cb83f1f4dcc005eff95c3ba25625129be9be6035f6b24b5ffaf26b80a3891a0a165dfef0890a9823639a7e993137816c7cecd8034de52a7fc5774c0d7
- TLSH T1BDE0391B9B28D7F187BCE2E8B9B04CF5AEF28868DA79002424DC4CCE0D5251368E7945
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 4c7ccb1c3f3bfd99719e83bb12e3344a18e00846e2521cdd6db67bce86ffc608
- MD5 cef662ed1a05152f50479c6ba767b20d
- SHA1 7d24a95518663a569a3f4749a963d65bc3b81766
- SHA512 497fc815a0c1832fb1708284e887518e72e6fad57cb878ec8ee33c2daa8529c6cf7ed763dd0af671955879d4ef554bba5c45cec19dc52cd261dad23af5022fda
- TLSH T1C42120813666AB53E8A0C23054FE4722FF30FA86C308661BC148320BAEB0E411F4D67F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 683B
- SHA256 61ec2ba4ec4ddce55131219adcd00b11e889438922fa0c2660dbe56eecdfa017
- MD5 65051220c3dbb5e0bbacbcc1f74b5b39
- SHA1 16919087192d31169d97f166c5460d7f5c37b8ed
- SHA512 2248a71b55de9ad876e2580b419576d8273cbc18b6d77d5ba15c3da8dc211e2e2ef66347ee81360b3d96c64a90f3bb2abf132e31b1693c21c1d36923bb9eeabc
- TLSH T10901E14122AA2307F8A0423488794766EF31B9559308764ED558324FAEB1E401F8E6BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ReceiveMount.doc.exe
- Size 513KB
- SHA256 a4a160ea0b324204f4d9458f7c30917c1e4999bb43d3133e7d80215fb76de0cc
- MD5 ac763f161fc4f06c67aae1bf5a048fea
- SHA1 f0a336ee086cc34838b17129074a5a4da1b0fdf8
- SHA512 5a155ec2f0ca095a53678b547906ca63dd0936375be8cf2229b08139575ba7282d96452faf1604f37845f0b220fc7192cd47b0633cce839b19c5e65785612215
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- TLSH T110B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RequestEdit\MountSet.doc.exe
- Size 513KB
- SHA256 feb0aa3f0e6e9035982230fc3082832fff196a4ff6f7d69239b928df581dc9d5
- MD5 393ca0df7bc190bad3d2b7bc3d8d024b
- SHA1 2ef9179e5038f176bc8a61ae2ea1e3771a5f4401
- SHA512 51b30ef185f3ee1b2b04f8bae7ace63920287440ff1bef2d98e645cf3341db21a8acf243e63ae4f34cfc1928b0fe2e41bd43c026bca7155d0e512bbc3e82e47a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T14EB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\gqiqpntdtgthd.exe
- Size 513KB
- SHA256 69e430d9f15954cca3374275adf52d4cb8988c6265107f00dd298081c4f85b2c
- MD5 23297b1fcb1d815f1bc95f30a9b12e71
- SHA1 fbc5a6868cbfe9c9ec5ce2c8e3b42f79d2e68d5c
- SHA512 920c147cc9196f0406d16b661327c221694d5ebd3fe16b74e95d5e68de7280a6e54c171497f2f718a3b2f3aa3726e20cee6f6c3ef039dbea16b357dabb6bb06a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6H:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm54
- TLSH T123B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nbbyacun.exe
- Size 513KB
- SHA256 a1ecfd1935a552b8425ff06107ba916d0719084a898c2d66af2fed87d8e97d95
- MD5 14aa276dd10d95ddd9a5ece7762fc53b
- SHA1 06c16e84b3056fe5c8d1bc0d9f579fb1d4b00172
- SHA512 bee3678cc765255bd6e929b4f94a1b2c22f2cfdfe1024f9e328045ef67ba066adcf42fec4cf4eb25351aa0e0c1507efcf1f343913e477ef4f5ba594f7e5b4e10
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- TLSH T1A7B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\omhatbklyz.exe
- Size 513KB
- SHA256 d0667d71ac4844c445850cd7ffb4695c6ac99c03708e164a5201166eb96a5615
- MD5 43292e6e348f73aec255adc92cad0eb8
- SHA1 2dae7b5caa8b9de917907384286e5e2d3a1d6e4d
- SHA512 69aee66392ffc9e5da9d1b984ff1a2543a6b2b3fc6dc77faf084b7bd7d05ced223dd63cf131f36d8a6ade2bef47760ed41d1b9ad4eabbdcfc565e8509df557a6
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T190B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\zqbgpkptroitufe.exe
- Size 513KB
- SHA256 1caf17e4961e3f1bc3a2afb5759b585f3746fbacc5663b6d297f4942df3c5e23
- MD5 d72f630bc168528c88ac79196e04d45d
- SHA1 1c76fa29bd154fae0049d75b75ba638748a4fdab
- SHA512 bcda67e0ad5a015be8dcf1ee27ccbe95a48fe2915ecbc3f06116845ec032cba4a7591e37257da3fde5f4c86165dbc5c1eb64bc26a9fa237e6570d8feb619f1ea
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T1FEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 6cd8a6fbe6ccb868327f3e31caa8531ebfcad57f9a2b98bddf40b221f50051aa
- MD5 00c0d17edabbcefa8166edd9f73cd353
- SHA1 c8d6f02cba95c88c6c2884b5e0b50a90c6dcbe20
- SHA512 7836c86d2f57e466217e0943c3dbc7fa4f4559bb59ba2e062b379d48ed3d75990ce884b121590fe458c657f8144369a9a9b50c1c0ec5f27056d2d0ac8a606109
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- TLSH T198B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 513KB
- SHA256 0b914660b0eb61926d9b14ab50a08fdf832f2c12502cf79a5b577d563750bb6a
- MD5 39213c99606e4a34fcc38075443a23fa
- SHA1 8d26012943082b96d62ed3c5e2371b179540ac25
- SHA512 4d35ba013582809edd1330413fd5bdca54204eb13762365f8025564a2b7452027a7520eee9f20422b0e5b398c9f7ba667296c1446d1950d378a6d37a6338aa9b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- TLSH T157B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH