Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 10:22
Behavioral task
behavioral1
Sample
2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe
- Size 512KB
- Sample260810-megldafe28
- SHA256 264932d52b57711f13c8975a9a79fd9219c73d9b80b992f3ace9ce6869b061a8
- MD5 70fd26d07cb4111f039c619e934b8700
- SHA1 99bcb8df6891ced91731ea36a815239cbcc60624
- SHA512 83d8db5c3507854a8053981b95cb8943fa802793970e90f9736e6cd5086861e05f9172f4362ec43980e45374bac8b327da617e72add37dfa2846223ea0f8da18
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- TLSH T1FCB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 12 IoCs
resource yara_rule behavioral1/files/0x0007000000024482-5.dat family_sohanad behavioral1/files/0x00120000000243fc-23.dat family_sohanad behavioral1/files/0x0007000000024483-29.dat family_sohanad behavioral1/files/0x0007000000024484-31.dat family_sohanad behavioral1/files/0x0003000000022ac8-65.dat family_sohanad behavioral1/files/0x000500000002332c-71.dat family_sohanad behavioral1/files/0x002b00000002394c-75.dat family_sohanad behavioral1/files/0x0009000000000745-99.dat family_sohanad behavioral1/files/0x0012000000000747-105.dat family_sohanad behavioral1/files/0x000400000002252d-111.dat family_sohanad behavioral1/files/0x0003000000016909-456.dat family_sohanad behavioral1/files/0x0003000000016909-460.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" opqbqnkncl.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" opqbqnkncl.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" opqbqnkncl.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" opqbqnkncl.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe - Executes dropped EXE 5 IoCs
pid Process 2584 opqbqnkncl.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 3148 ovlrgacxvkvnf.exe 216 ldeygbnm.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" opqbqnkncl.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\daqhnfqx = "opqbqnkncl.exe" tsqxjcfpokyxjbz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qpwspfgo = "tsqxjcfpokyxjbz.exe" tsqxjcfpokyxjbz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ovlrgacxvkvnf.exe" tsqxjcfpokyxjbz.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: opqbqnkncl.exe File opened (read-only) \??\g: ldeygbnm.exe File opened (read-only) \??\j: ldeygbnm.exe File opened (read-only) \??\i: ldeygbnm.exe File opened (read-only) \??\p: ldeygbnm.exe File opened (read-only) \??\y: ldeygbnm.exe File opened (read-only) \??\l: ldeygbnm.exe File opened (read-only) \??\t: ldeygbnm.exe File opened (read-only) \??\t: ldeygbnm.exe File opened (read-only) \??\w: ldeygbnm.exe File opened (read-only) \??\i: opqbqnkncl.exe File opened (read-only) \??\q: opqbqnkncl.exe File opened (read-only) \??\r: opqbqnkncl.exe File opened (read-only) \??\k: ldeygbnm.exe File opened (read-only) \??\m: ldeygbnm.exe File opened (read-only) \??\q: ldeygbnm.exe File opened (read-only) \??\h: ldeygbnm.exe File opened (read-only) \??\s: ldeygbnm.exe File opened (read-only) \??\u: ldeygbnm.exe File opened (read-only) \??\w: ldeygbnm.exe File opened (read-only) \??\y: ldeygbnm.exe File opened (read-only) \??\b: ldeygbnm.exe File opened (read-only) \??\g: ldeygbnm.exe File opened (read-only) \??\m: opqbqnkncl.exe File opened (read-only) \??\p: opqbqnkncl.exe File opened (read-only) \??\a: opqbqnkncl.exe File opened (read-only) \??\n: opqbqnkncl.exe File opened (read-only) \??\u: opqbqnkncl.exe File opened (read-only) \??\z: opqbqnkncl.exe File opened (read-only) \??\i: ldeygbnm.exe File opened (read-only) \??\z: ldeygbnm.exe File opened (read-only) \??\b: opqbqnkncl.exe File opened (read-only) \??\s: opqbqnkncl.exe File opened (read-only) \??\l: ldeygbnm.exe File opened (read-only) \??\r: ldeygbnm.exe File opened (read-only) \??\n: ldeygbnm.exe File opened (read-only) \??\t: opqbqnkncl.exe File opened (read-only) \??\w: opqbqnkncl.exe File opened (read-only) \??\x: opqbqnkncl.exe File opened (read-only) \??\a: ldeygbnm.exe File opened (read-only) \??\e: ldeygbnm.exe File opened (read-only) \??\k: ldeygbnm.exe File opened (read-only) \??\x: ldeygbnm.exe File opened (read-only) \??\z: ldeygbnm.exe File opened (read-only) \??\g: opqbqnkncl.exe File opened (read-only) \??\n: ldeygbnm.exe File opened (read-only) \??\j: opqbqnkncl.exe File opened (read-only) \??\o: opqbqnkncl.exe File opened (read-only) \??\v: opqbqnkncl.exe File opened (read-only) \??\e: ldeygbnm.exe File opened (read-only) \??\o: ldeygbnm.exe File opened (read-only) \??\p: ldeygbnm.exe File opened (read-only) \??\m: ldeygbnm.exe File opened (read-only) \??\o: ldeygbnm.exe File opened (read-only) \??\q: ldeygbnm.exe File opened (read-only) \??\h: opqbqnkncl.exe File opened (read-only) \??\l: opqbqnkncl.exe File opened (read-only) \??\r: ldeygbnm.exe File opened (read-only) \??\s: ldeygbnm.exe File opened (read-only) \??\v: ldeygbnm.exe File opened (read-only) \??\e: opqbqnkncl.exe File opened (read-only) \??\b: ldeygbnm.exe File opened (read-only) \??\h: ldeygbnm.exe File opened (read-only) \??\v: ldeygbnm.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" opqbqnkncl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" opqbqnkncl.exe - AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3560-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0007000000024482-5.dat autoit_exe behavioral1/files/0x00120000000243fc-23.dat autoit_exe behavioral1/files/0x0007000000024483-29.dat autoit_exe behavioral1/files/0x0007000000024484-31.dat autoit_exe behavioral1/files/0x0003000000022ac8-65.dat autoit_exe behavioral1/files/0x000500000002332c-71.dat autoit_exe behavioral1/files/0x002b00000002394c-75.dat autoit_exe behavioral1/files/0x0009000000000745-99.dat autoit_exe behavioral1/files/0x0012000000000747-105.dat autoit_exe behavioral1/files/0x000400000002252d-111.dat autoit_exe behavioral1/files/0x0003000000016909-456.dat autoit_exe behavioral1/files/0x0003000000016909-460.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ldeygbnm.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\ovlrgacxvkvnf.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification C:\Windows\SysWOW64\opqbqnkncl.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File created C:\Windows\SysWOW64\tsqxjcfpokyxjbz.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\tsqxjcfpokyxjbz.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ldeygbnm.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ovlrgacxvkvnf.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll opqbqnkncl.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ldeygbnm.exe File created C:\Windows\SysWOW64\opqbqnkncl.exe 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe - Drops file in Program Files directory 21 IoCs
description ioc Process File created \??\c:\Program Files\ExitSet.doc.exe ldeygbnm.exe File opened for modification \??\c:\Program Files\ExitSet.doc.exe ldeygbnm.exe File opened for modification C:\Program Files\ExitSet.nal ldeygbnm.exe File opened for modification \??\c:\Program Files\ExitSet.doc.exe ldeygbnm.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ldeygbnm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ldeygbnm.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ldeygbnm.exe File opened for modification C:\Program Files\ExitSet.doc.exe ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ldeygbnm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ldeygbnm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ldeygbnm.exe File opened for modification C:\Program Files\ExitSet.doc.exe ldeygbnm.exe File opened for modification C:\Program Files\ExitSet.nal ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ldeygbnm.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ldeygbnm.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ldeygbnm.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ldeygbnm.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ldeygbnm.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ldeygbnm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language opqbqnkncl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tsqxjcfpokyxjbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldeygbnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ovlrgacxvkvnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldeygbnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFEFCF8482C82139146D75F7D96BCE5E634593566416330D7E9" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" opqbqnkncl.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat opqbqnkncl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh opqbqnkncl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB4FF1C21D0D27ED0A88B789062" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C70E14E5DBC3B9BB7CE2EDE034C6" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc opqbqnkncl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33372D789D5783226D4676A570562CA97DF664AC" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8F9CEFE17F291837A3B42869D3E91B08002FF42610248E1C4429B09A0" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B12E479238EB53C9BAD0329BD7CB" 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" opqbqnkncl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs opqbqnkncl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" opqbqnkncl.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4528 WINWORD.EXE 4528 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3092 tsqxjcfpokyxjbz.exe 3092 tsqxjcfpokyxjbz.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3696 ldeygbnm.exe 3092 tsqxjcfpokyxjbz.exe 3092 tsqxjcfpokyxjbz.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3092 tsqxjcfpokyxjbz.exe 216 ldeygbnm.exe 216 ldeygbnm.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 216 ldeygbnm.exe 216 ldeygbnm.exe 216 ldeygbnm.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 3696 ldeygbnm.exe 2584 opqbqnkncl.exe 3148 ovlrgacxvkvnf.exe 3092 tsqxjcfpokyxjbz.exe 216 ldeygbnm.exe 216 ldeygbnm.exe 216 ldeygbnm.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4528 WINWORD.EXE 4528 WINWORD.EXE 4528 WINWORD.EXE 4528 WINWORD.EXE 4528 WINWORD.EXE 4528 WINWORD.EXE 4528 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3560 wrote to memory of 2584 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 87 PID 3560 wrote to memory of 3092 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 88 PID 3560 wrote to memory of 3696 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 89 PID 3560 wrote to memory of 3148 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 90 PID 3560 wrote to memory of 4528 3560 2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe 91 PID 2584 wrote to memory of 216 2584 opqbqnkncl.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_70fd26d07cb4111f039c619e934b8700_elex_stop_yuner.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\opqbqnkncl.exeopqbqnkncl.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\ldeygbnm.exeC:\Windows\system32\ldeygbnm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:216
-
-
-
C:\Windows\SysWOW64\tsqxjcfpokyxjbz.exetsqxjcfpokyxjbz.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3092
-
-
C:\Windows\SysWOW64\ldeygbnm.exeldeygbnm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3696
-
-
C:\Windows\SysWOW64\ovlrgacxvkvnf.exeovlrgacxvkvnf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3148
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4528
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\ExitSet.doc.exe
- Size 512KB
- SHA256 aec53bdda24580180b51abc2ccd7e5aa6ccc59200303ec3ffc92c5d7153b6f13
- MD5 7882698f335f5a6ed44be83bd90fd4c4
- SHA1 aff81fcc1b1bb60a6d675e63ffe279d02d0f94ed
- SHA512 cf8a14be75a15fff690bc09e1da3dbc4f851f7237480129a16649f1fbb79590a49730007435335ef60702df87244fd900ded3c273e23cc0208a4d9359c59151d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- TLSH T1ADB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 bddf3c2c78de8cd8783044c02c6e2538642df8c2a1bc3242abd19b30a84eba81
- MD5 8b34b5330560de8fc57a625c65d9f31c
- SHA1 8395a51fb1c4942ade0eb2cd32bb435b6763be39
- SHA512 608b8426458c5428bccdc5bf25ce81282eb6ecbb1bd378d77eaad87f53cf672bd33d6e286e67c8bba339411a9a1cd9b8069049df43b1104190cb31b1451c70f9
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T103B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 ea1a49d224cbb0e530986a9fc1e51a369564e671c32483c2b9e7a8c5c8a6043f
- MD5 aa0fcc1f2ac26fced8614d54efd310a0
- SHA1 9e306df28a170e7ed01aa49cc1b652e15b095d44
- SHA512 60f75e9b06ee4651284fffaffb637c2c40f9a89c9c467757109f9ec1c4cdef3414ec7cb7250bea5d5c3fa71756237140b8a21d2340ac8b8cf6c521586cc9d9d7
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O
- TLSH T103B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD9AEB.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\EnableHide\ExitReceive.doc.exe
- Size 512KB
- SHA256 c27eea92f890d85c2c00e3a38145d1881ae31bb3d64fa0211f9df6fb70ac0ff6
- MD5 71bc394db8fc9156ff978a868f51f8d0
- SHA1 464e544505338e45411f6016ed3b8cce1718c4e7
- SHA512 b8b9c9d8751049a4b6471bba5966d1255a2382b7cbc1719909c71f2dd2eb21c0fd367d283165c8c19b37cc930dec7975e98d37293d03bac5d9da064b2d3886cd
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T18DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 364B
- SHA256 dcd5b4f54b373c9a1ef6246ed77025bd0906c4ac5b5480b0542c37d7ddb37bcb
- MD5 f2c4a3c960e9f7ec5f167e6e70852cd4
- SHA1 1ee13fd2ff50fb4ad9839a195372c5f781f99499
- SHA512 a8555f8f474170fa81d1735618b3515f9b464ab2830642467d462a6960226a130898e59488129afae23c58a51c6fce4631a336624088cd3d7a4b7880891f889b
- TLSH T1C5E04FABB720EBF0837E91A47DB81CF447F64854E36A80211ADC0C840EB02D3139B409
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 ef008d05caa2780ab9bfa5a97da3d82dfc85fa0af555a2876f5d65c89d553475
- MD5 938b9e5eb9e696a45da488530b5f384f
- SHA1 7206692691de43ad85e0b3ed4ea09da25d64f39b
- SHA512 a66a372275075777ba8c810e97bd1ae7f885bb0c306f6c6b28210976a59347e8bd3a8cb4c39c0051c413034fc47c2a3d86b7393fefe6824201af7a1377a4a551
- TLSH T136810D4217CB6EE6D0A4833BC12F5316DBB03C02D714760A6A85651ABDB0D409E6FBEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 6d9dc46d00f5a5d80ddb4ea66dec76fa112d3fca3d30a4646cf6c53c14ecbe44
- MD5 1fc252c2fff1f3612c2ff30e6f8379dc
- SHA1 dc68a71d858dcc781c8fd922b217b51c8d152dc5
- SHA512 4c363bc8064f09fc52f57dc742e6d1b7f58faed4b1b60f6c5d6eee3ff6e58210727a68933747422374a66b128f789ff3d2a348f7fb043ed7dc54009b7e90d689
- TLSH T14261FD4217CB6EAAD0648337C23F4316DBB03C02D714770A6A85251AAD71D409E6FBEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\ProtectRedo\DisableClear.doc.exe
- Size 512KB
- SHA256 9fe20e911f6f4099cfda902390affd513a9ed94d79643231a34e40a7de97b5f5
- MD5 44444a915e25a55125e744c6c97e5b68
- SHA1 735550457458d2227229b14a9a522f2216bbad2a
- SHA512 61e4d2f145a303095823755da8bac421d4ef4526bbaec4823db8c5824ed7d4264b58adf714d1239db7401fada5b5ca39046fcfe53216f0993755868ac4ade634
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- TLSH T1C7B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\SuspendSave.doc.exe
- Size 512KB
- SHA256 19101f668572f36da075888bd7dcbf913a55e7518458df1c14d70dbb9c6154f6
- MD5 f2cbe1935ca10904a6a15d244ef0f875
- SHA1 d985fb99f8adf0b7061685c2a8798864db23fd3d
- SHA512 1c2be146913b76d1fc03db28749bfe8912d9f9c51070e98aeb2f4d1ec8499b58a560f9817c38081cae22fdc2ea519b142fa2adc124b692d06acf80919585e3c6
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- TLSH T1F5B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ldeygbnm.exe
- Size 512KB
- SHA256 bb0cf73d45547200b0461139f35771cb8e6cc24eef2a742204cecfdfa4aec626
- MD5 f9d2c70c178c3ac2a9a1fcd650e504bb
- SHA1 d7d1f9c77f1ef9b05f20751792e5d3bc61267630
- SHA512 4729c20bf5647673a52577b8144c1c17d86a7bf1eb5888cd54934350925a9ceaefb6ca1ff3cb259433f55668771774f4caef0762ff4fb737efa25f5267b3b6ff
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- TLSH T188B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\opqbqnkncl.exe
- Size 512KB
- SHA256 f40fd2d8e10777e59717cea5884c2987f084bc12562c8ca92fa09ffbc2679d40
- MD5 e67e2c35dc04c79a8b8848685ee9b016
- SHA1 84a51600161d8e3f8d3828ad08583d0bf3a9bd42
- SHA512 1ff3bb0359dc76308d3cc9f15a878fad4c9afbe28e43d95fe4de8a1075fb39bf746f76be1200d3c86403ce26a0b493fbacd907617b49d62e74b205bac8d6aaf0
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T10BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ovlrgacxvkvnf.exe
- Size 512KB
- SHA256 fa2073248eca32beb30ef7e34743f9701567c4281062ea359c6f0906a0c2e3c2
- MD5 09296017d7b66864d91305ed040eced3
- SHA1 d7bba1d4aa033b5cc47f47c87fbfb873e10a1168
- SHA512 628d055471e2a0b75202d6b03aa113d3ce2679e334dde50000128101576de04630d14dc353f2a46c3aeb9023575ab204db7fbae789e46547f6b06e4aa2e27aa7
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- TLSH T1D8B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tsqxjcfpokyxjbz.exe
- Size 512KB
- SHA256 4c0e486baf048948145578f3eabdae513497254615ec41f98efc17dde5bba56d
- MD5 6f4c1c6b6acc346608a673af89d72284
- SHA1 0018b3d4ac5de8f126fc97fc0f60b20f2db5545e
- SHA512 6975250eda4f47e6546a0eb3e7d4b477c2358e19f61863c5929a3638bd4c23775766f6342607b5492ac21e698a8e6145204396906ad002f8bb10c57673d29e2f
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- TLSH T1D8B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 6c327da05b550fb98c357078de4b78de5e1678b45a86ece92a3a557227cde9a7
- MD5 7410504f39843f73c270895f68e8fcda
- SHA1 5a2b67d0ce9269c9d1ba47137f1a3db7d7509a5d
- SHA512 e7b05819e1769e0bbf11946840cd0cffbbc55cbd362d55935068dec4cb575a1fcec5672e14b32e2d2b61a6eae249cc8b0c2bf078485f99286fc114d21c3d795d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T122B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 82ba9b2d4f7bfbff5a195a977fd2fb1df80fdb3711f78be96314a7895ef1cc87
- MD5 4dce1690e15ece515838f12134cf6b3c
- SHA1 c1f29f644bd2d36df6a19772ba55da112c3bc682
- SHA512 aaab65da4dafc947713f86e2aba465fe6b4ea79da235ef8abaa5efca8d7a3287d5053825103c2874584bbaca294715cfaf3c1b062eb439a8e7b521ac9844bc03
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- TLSH T192B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH