Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 23:16
Behavioral task
behavioral1
Sample
2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe
- Size 512KB
- Sample260722-289xcadd32
- SHA256 3eed10d5c41920da5a8081c9620f9c0c9a85dd0c73d4436dc1e7f6f0361fa783
- MD5 cd93441e964fca7c15d70df7316ddc66
- SHA1 21c1765e9255dd18d43450855191613d757e45bf
- SHA512 be36db7cc5be09907b16d1da528692a40f305778563a9acd622c602afa46b3cabcc5f5d46c81950fe560a08ef89cc3b888d313d8c656c6679863506446093026
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- TLSH T1E3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 11 IoCs
resource yara_rule behavioral2/files/0x000500000001b871-5.dat family_sohanad behavioral2/files/0x000a000000011390-12.dat family_sohanad behavioral2/files/0x0005000000016b3f-17.dat family_sohanad behavioral2/files/0x001800000001c4c9-26.dat family_sohanad behavioral2/files/0x000d00000001c520-57.dat family_sohanad behavioral2/files/0x000d00000001c521-60.dat family_sohanad behavioral2/files/0x000d00000001c522-62.dat family_sohanad behavioral2/files/0x000d00000001c523-66.dat family_sohanad behavioral2/files/0x000d00000001c524-69.dat family_sohanad behavioral2/files/0x000d00000001c527-86.dat family_sohanad behavioral2/files/0x000d00000001c527-91.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" gudqauhscn.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gudqauhscn.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gudqauhscn.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gudqauhscn.exe - Executes dropped EXE 5 IoCs
pid Process 3688 gudqauhscn.exe 5400 owojfihntfueiaa.exe 5976 syfurmpt.exe 4976 mzvhwzycssaks.exe 2308 syfurmpt.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gudqauhscn.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rugqovem = "gudqauhscn.exe" owojfihntfueiaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jkdwzyja = "owojfihntfueiaa.exe" owojfihntfueiaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mzvhwzycssaks.exe" owojfihntfueiaa.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: syfurmpt.exe File opened (read-only) \??\i: syfurmpt.exe File opened (read-only) \??\d: gudqauhscn.exe File opened (read-only) \??\h: gudqauhscn.exe File opened (read-only) \??\j: gudqauhscn.exe File opened (read-only) \??\l: gudqauhscn.exe File opened (read-only) \??\m: gudqauhscn.exe File opened (read-only) \??\l: syfurmpt.exe File opened (read-only) \??\p: gudqauhscn.exe File opened (read-only) \??\r: gudqauhscn.exe File opened (read-only) \??\p: syfurmpt.exe File opened (read-only) \??\a: syfurmpt.exe File opened (read-only) \??\a: gudqauhscn.exe File opened (read-only) \??\m: syfurmpt.exe File opened (read-only) \??\u: syfurmpt.exe File opened (read-only) \??\g: syfurmpt.exe File opened (read-only) \??\b: gudqauhscn.exe File opened (read-only) \??\g: gudqauhscn.exe File opened (read-only) \??\n: syfurmpt.exe File opened (read-only) \??\n: gudqauhscn.exe File opened (read-only) \??\i: syfurmpt.exe File opened (read-only) \??\k: syfurmpt.exe File opened (read-only) \??\l: syfurmpt.exe File opened (read-only) \??\q: syfurmpt.exe File opened (read-only) \??\v: syfurmpt.exe File opened (read-only) \??\x: syfurmpt.exe File opened (read-only) \??\v: gudqauhscn.exe File opened (read-only) \??\m: syfurmpt.exe File opened (read-only) \??\n: syfurmpt.exe File opened (read-only) \??\k: gudqauhscn.exe File opened (read-only) \??\s: gudqauhscn.exe File opened (read-only) \??\t: syfurmpt.exe File opened (read-only) \??\k: syfurmpt.exe File opened (read-only) \??\t: syfurmpt.exe File opened (read-only) \??\y: syfurmpt.exe File opened (read-only) \??\a: syfurmpt.exe File opened (read-only) \??\d: syfurmpt.exe File opened (read-only) \??\b: syfurmpt.exe File opened (read-only) \??\i: gudqauhscn.exe File opened (read-only) \??\s: syfurmpt.exe File opened (read-only) \??\w: syfurmpt.exe File opened (read-only) \??\t: gudqauhscn.exe File opened (read-only) \??\z: gudqauhscn.exe File opened (read-only) \??\h: syfurmpt.exe File opened (read-only) \??\z: syfurmpt.exe File opened (read-only) \??\h: syfurmpt.exe File opened (read-only) \??\j: syfurmpt.exe File opened (read-only) \??\w: syfurmpt.exe File opened (read-only) \??\p: syfurmpt.exe File opened (read-only) \??\s: syfurmpt.exe File opened (read-only) \??\u: syfurmpt.exe File opened (read-only) \??\u: gudqauhscn.exe File opened (read-only) \??\w: gudqauhscn.exe File opened (read-only) \??\d: syfurmpt.exe File opened (read-only) \??\o: syfurmpt.exe File opened (read-only) \??\r: syfurmpt.exe File opened (read-only) \??\v: syfurmpt.exe File opened (read-only) \??\z: syfurmpt.exe File opened (read-only) \??\o: gudqauhscn.exe File opened (read-only) \??\x: gudqauhscn.exe File opened (read-only) \??\b: syfurmpt.exe File opened (read-only) \??\g: syfurmpt.exe File opened (read-only) \??\r: syfurmpt.exe File opened (read-only) \??\q: syfurmpt.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" gudqauhscn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" gudqauhscn.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5980-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000500000001b871-5.dat autoit_exe behavioral2/files/0x000a000000011390-12.dat autoit_exe behavioral2/files/0x0005000000016b3f-17.dat autoit_exe behavioral2/files/0x001800000001c4c9-26.dat autoit_exe behavioral2/files/0x000d00000001c520-57.dat autoit_exe behavioral2/files/0x000d00000001c521-60.dat autoit_exe behavioral2/files/0x000d00000001c522-62.dat autoit_exe behavioral2/files/0x000d00000001c523-66.dat autoit_exe behavioral2/files/0x000d00000001c524-69.dat autoit_exe behavioral2/files/0x000d00000001c527-86.dat autoit_exe behavioral2/files/0x000d00000001c527-91.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\syfurmpt.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File created C:\Windows\SysWOW64\mzvhwzycssaks.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\mzvhwzycssaks.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe syfurmpt.exe File created C:\Windows\SysWOW64\gudqauhscn.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\gudqauhscn.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\syfurmpt.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll gudqauhscn.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe syfurmpt.exe File created C:\Windows\SysWOW64\owojfihntfueiaa.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\owojfihntfueiaa.exe 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal syfurmpt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal syfurmpt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe syfurmpt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe syfurmpt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe syfurmpt.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe syfurmpt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe syfurmpt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe syfurmpt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe syfurmpt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syfurmpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gudqauhscn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language owojfihntfueiaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syfurmpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mzvhwzycssaks.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFC8D4F2685199046D62D7E9CBDEEE631584467466335D6EE" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC67A15E6DBC7B9CE7F92ED9434C8" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh gudqauhscn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf gudqauhscn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33442D7D9C2D82276A4677D5702E2DDD7DF664D7" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB1B0584793389852CCBAA633EED4BB" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F368B0FE1A22D9D27FD1A88A7C9167" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" gudqauhscn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAF9CAF962F193830F3B3186EC39E6B38B028B4214033CE1BE429A08D2" 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gudqauhscn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc gudqauhscn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" gudqauhscn.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1964 WINWORD.EXE 1964 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 2308 syfurmpt.exe 2308 syfurmpt.exe 2308 syfurmpt.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 3688 gudqauhscn.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 5976 syfurmpt.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 4976 mzvhwzycssaks.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 5400 owojfihntfueiaa.exe 2308 syfurmpt.exe 2308 syfurmpt.exe 2308 syfurmpt.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE 1964 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5980 wrote to memory of 3688 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 89 PID 5980 wrote to memory of 5400 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 90 PID 5980 wrote to memory of 5976 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 91 PID 5980 wrote to memory of 4976 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 92 PID 5980 wrote to memory of 1964 5980 2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe 93 PID 3688 wrote to memory of 2308 3688 gudqauhscn.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_cd93441e964fca7c15d70df7316ddc66_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\gudqauhscn.exegudqauhscn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\syfurmpt.exeC:\Windows\system32\syfurmpt.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2308
-
-
-
C:\Windows\SysWOW64\owojfihntfueiaa.exeowojfihntfueiaa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5400
-
-
C:\Windows\SysWOW64\syfurmpt.exesyfurmpt.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5976
-
-
C:\Windows\SysWOW64\mzvhwzycssaks.exemzvhwzycssaks.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4976
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1964
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD426B.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 335B
- SHA256 7b24b1bacc0d85887d290ee2e8efc327d2a71eaf8d1f113ff5b8fd4a6f4353e9
- MD5 7cdc3e71ecaa1b5354340c7a80ff0dba
- SHA1 c13dd278dcc05f75a2e50ce6c82d7380618448a1
- SHA512 e8d2eedf617021476528f95013bb6feab5c2982e77d607b4633681de9cddd78251f271a742ff279b47a9aa60714b36f3a0fa9ee507b5843eb00e48a082d361b0
- TLSH T13AE08C1B5B61F3F3437CA6983C385DE45FF38C98E2AD016209CC1CC61D15283AA5B84E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 f430773cc3be56b6d921605f5f6cd7452a3f4d95e07519c1238c3a52fdb4c808
- MD5 60654245c1ad2f6ec7edf650c5e93f54
- SHA1 3da8d4c4bcd4f1274d835ee3bcf99ab797ee324b
- SHA512 5fe8331e6996970433cb47af9ad5344aa4918092fa436eb9d69b03cdbe35fc311c56363a75cd7a6e1eef2a9fb1e072319da18c319cb4e968781ee326060cdc89
- TLSH T1B751F10317AFAB57D08142B6716F9305DF727C42FE64AB1E17A4622B7C71A008E8D65B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 4f40f919ac3cf1ef8dc9a65e4f09dc391c1ece679cc9499c7ac0b3fad7ef0bc9
- MD5 2150ed08cdd65cf969133a525a0b092c
- SHA1 5fc868bc350ce18c7072a8e1dae7e445f7079734
- SHA512 0d9de6e25216e0df7a392f852fa628d04c9eeb48d0e38c3ca7d278dccd3efd582086692c2534d3b0bc1461607aa6edc92f805096c74e9ed9d7d74cf0f16db51b
- TLSH T18441BE0367DF6B17D08003B6722F8345DE727C82F964671E57D4622B7C61E108E8DA5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\UnpublishEdit\ExitInstall.doc.exe
- Size 512KB
- SHA256 da069a155d1c9c4f43a550dda1b6495ced24ae7960898f23609e71e215714f49
- MD5 f1cef0ae2d7f9a77014cf7daf10d6334
- SHA1 f1bf2579651e6d8ef73c289835e5041b4c3f4e66
- SHA512 3b44d2365ff64a7ee111c1eb6b531bfcaa78e890f28bfee48ee6b5fad1ab337a51064a19ce4450b989ddcc0e8ecf2dfc10c31ab7dc14d37a9562640122d947ea
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- TLSH T1E3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Music\ImportTest.doc.exe
- Size 512KB
- SHA256 ef0b88f2956e75e774fac4d25e9626a0ed806b65bd71787540636799b862cac9
- MD5 4d1a1876720857628c31e9a7437791a0
- SHA1 9f4972e3582872341621d1fb1d6394353edb2fe0
- SHA512 27d34c13fe4972d8288163dbbb509ab2f1a0d909a0e50c96c09034ca196682ab5763d320ba373fcfa4744b3270ea7d8e7eda99724e7be582bbd1a5ce723984c3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T142B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\gudqauhscn.exe
- Size 512KB
- SHA256 31c5fb6d1d6ed0e25b7da652b6143076b2689162de9dc2f5c8458f6e4abcf8e6
- MD5 7b77342c513991f1da15c6cf50ed77ae
- SHA1 b192ab0704602f47f917e059da337468fc1b66cd
- SHA512 70a8a59d84805b030fe3a5dc0fc2e9531113e176c0c62edae4b06b9f4c548d2034d4291193c48fb02eb9e2fe635a173088c6888346d494ae2b63628a563ed711
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- TLSH T105B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\mzvhwzycssaks.exe
- Size 512KB
- SHA256 6547c8336ca7f3da5031fb33326f6afe9134f6794663a5e35a71bdf473ff4836
- MD5 645f28bd16a5fa439eb9478f2aa180f6
- SHA1 2bcd7f5fe1159bb3f1ce0173f70d5c7a1f93b455
- SHA512 71686f8ab544811f770a41efce82aa0dfed154d33932a641ecf3db4ca9e22773f3ba2591de67fe1652e97bbca44b77872d748d8eccc1f878d77a7edf11ce6408
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6+:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T1BFB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\owojfihntfueiaa.exe
- Size 512KB
- SHA256 5fca033371f9e9dbed78af559509476b2f06c392b7a68628aa54f4a43e8a775e
- MD5 73f0da3d071f03d4ba0fee91977d97b8
- SHA1 c31c57e4443a9c7d7a295731d7a2fe26aa93494a
- SHA512 154b650eb78d0fc264ea9e3d4928b7c2d54d9e8dbe94e2e862d12134983089f7c4ece33f1f98df69f0ffe92eb2fe6eef364ffc3c88041cbefbb383bd04ccb443
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T16AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syfurmpt.exe
- Size 512KB
- SHA256 b5d35a0af460a8a824295021819110a5f4c05223a610afaa833009355a883880
- MD5 23a3017a8c4ea7f2fe6e4700aa9c3fa0
- SHA1 51c2037309bd80da9fca7c600a31efdce093b8bf
- SHA512 d21fb789bcbae1bbdac8a5d441ed2cf49fe8d9e032259dda4ddb2d920cf205e44da557143d90033ae0cf4990632dcddd698b8cd3e53408bcabe5bd4418159b6d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- TLSH T105B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 13ff377dc5e9e49f218eb2ed00078aaca802ba09935ed675349eaa7369136105
- MD5 9c2ba5dae4637252191841094237733e
- SHA1 fc5e29758ce8704c9596d5208f11ffa31f6d25c4
- SHA512 15cbd15d2ee0fdb6899fe0980284031fd8ba897669d6f368edab7be4a64b440a5739d603698ee1e28fdfe70adc60a2d160453d8e6829f5a6851b28db2d46641e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- TLSH T1C5B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Roaming\ConvertToRevoke\ResolveRestore.doc.exe
- Size 512KB
- SHA256 03030217e3b5b08f5f7a1d62ee67b1b048ccdc18e421ba7d58c71f97413c3d57
- MD5 63230dddcfc17f47d208dc8f0aeae67e
- SHA1 6f40d994615d34106cf441078d523bba5c92ea9a
- SHA512 697545522ae22fe1276db754f104bc56b0f114bee0f98549bb949e80de2abc44b20c4f60fe2c69c68297d9b59edee71273b01ba726380f2f52f552b05415efc3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T13CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Roaming\ReceiveMount\OutFind.doc.exe
- Size 512KB
- SHA256 946cf4f804ef5b91e923ca50b5163007cfdbc7c1fb07e86f9de1b9844ec71ddb
- MD5 a2556cd2a0eb1da35a2cca944c882fdc
- SHA1 812eb26b3dbdaf6d965fe7469edfcc94793906f9
- SHA512 44ad707c8ba9a11681db47ff16020d33335b444412e95d2a99628c59606e9f07439a8bb72e7778a516e65e3bfb3101498fc4079ab477583ac432210632b4250e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- TLSH T155B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 accec144dbb7e9d5209faaec58d229b4ff26f1c5daaa4ca20aab267341b25422
- MD5 24afa2a33b36da62897c6fe59ec73208
- SHA1 07b13a08513f3ae490d4ec3f99f03cd95463a31b
- SHA512 bfc074a1bbd96d835daa3614ba9d97747a118907c7251b406c30db1c2822864287435b330049712cfbf7202d6c589cb931a2ae8fcd8603dc6d4270338dff9f50
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T126B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 b1ac52d6ab454ef96ae5c3726657519619975e798279b469a04e254a4b860ac1
- MD5 b8e08f8669daa9f6b755d384ea42c8ca
- SHA1 95cff646e55798fce692a6fe50d83ec5756cdbe2
- SHA512 0935dc5a28d0af983fc12c7880448b91b183bf542780fbc16402d2fade4e92aedfce3bf839d0a2962c831f985bc53fcf682cb1580683f1a964d1e28503451627
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- TLSH T13FB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH