Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 17:29
Behavioral task
behavioral1
Sample
2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe
- Size 512KB
- Sample260818-v2zdpsxamd
- SHA256 b42ce615a1847ee83ae1602e3fd0377dac73eed0ee8f5fe26d2fe6a502d9ea03
- MD5 83f503f3446b256c5e78006beb8bd207
- SHA1 20324b9189c0b8fdf1f3cb4f6e0fc844e079a34b
- SHA512 c936c73b9eb7264f28a4e6ce3e69b92deaea3825fda333ac90227aa76feed89fe7c8a3608e4f8dc3b04f0f6a1613d6acf75313541d566de58cea57e68bb19133
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T194B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 11 IoCs
resource yara_rule behavioral1/files/0x0008000000024502-5.dat family_sohanad behavioral1/files/0x001c0000000243fa-18.dat family_sohanad behavioral1/files/0x0007000000024508-32.dat family_sohanad behavioral1/files/0x0007000000024507-29.dat family_sohanad behavioral1/files/0x0004000000011943-67.dat family_sohanad behavioral1/files/0x000700000002451b-71.dat family_sohanad behavioral1/files/0x000400000001da56-92.dat family_sohanad behavioral1/files/0x000400000001da8b-98.dat family_sohanad behavioral1/files/0x000300000001da91-104.dat family_sohanad behavioral1/files/0x000600000001dabe-228.dat family_sohanad behavioral1/files/0x000600000001dabe-233.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" xledfkuyqo.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xledfkuyqo.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" xledfkuyqo.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xledfkuyqo.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe - Executes dropped EXE 5 IoCs
pid Process 2500 xledfkuyqo.exe 3776 nkyfqtqsnamzakf.exe 668 zbsfrcvs.exe 4496 cjljdzcgtkeaw.exe 4532 zbsfrcvs.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" xledfkuyqo.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nntzhgdy = "xledfkuyqo.exe" nkyfqtqsnamzakf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\czgfmugb = "nkyfqtqsnamzakf.exe" nkyfqtqsnamzakf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cjljdzcgtkeaw.exe" nkyfqtqsnamzakf.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: zbsfrcvs.exe File opened (read-only) \??\a: xledfkuyqo.exe File opened (read-only) \??\q: xledfkuyqo.exe File opened (read-only) \??\o: zbsfrcvs.exe File opened (read-only) \??\i: xledfkuyqo.exe File opened (read-only) \??\o: zbsfrcvs.exe File opened (read-only) \??\x: zbsfrcvs.exe File opened (read-only) \??\l: zbsfrcvs.exe File opened (read-only) \??\v: zbsfrcvs.exe File opened (read-only) \??\g: xledfkuyqo.exe File opened (read-only) \??\m: xledfkuyqo.exe File opened (read-only) \??\p: xledfkuyqo.exe File opened (read-only) \??\w: xledfkuyqo.exe File opened (read-only) \??\e: zbsfrcvs.exe File opened (read-only) \??\q: zbsfrcvs.exe File opened (read-only) \??\n: zbsfrcvs.exe File opened (read-only) \??\w: zbsfrcvs.exe File opened (read-only) \??\t: xledfkuyqo.exe File opened (read-only) \??\u: xledfkuyqo.exe File opened (read-only) \??\b: zbsfrcvs.exe File opened (read-only) \??\k: zbsfrcvs.exe File opened (read-only) \??\t: zbsfrcvs.exe File opened (read-only) \??\w: zbsfrcvs.exe File opened (read-only) \??\y: zbsfrcvs.exe File opened (read-only) \??\r: xledfkuyqo.exe File opened (read-only) \??\s: xledfkuyqo.exe File opened (read-only) \??\z: xledfkuyqo.exe File opened (read-only) \??\j: zbsfrcvs.exe File opened (read-only) \??\z: zbsfrcvs.exe File opened (read-only) \??\e: zbsfrcvs.exe File opened (read-only) \??\x: xledfkuyqo.exe File opened (read-only) \??\r: zbsfrcvs.exe File opened (read-only) \??\u: zbsfrcvs.exe File opened (read-only) \??\k: xledfkuyqo.exe File opened (read-only) \??\p: zbsfrcvs.exe File opened (read-only) \??\t: zbsfrcvs.exe File opened (read-only) \??\b: xledfkuyqo.exe File opened (read-only) \??\e: xledfkuyqo.exe File opened (read-only) \??\h: xledfkuyqo.exe File opened (read-only) \??\s: zbsfrcvs.exe File opened (read-only) \??\q: zbsfrcvs.exe File opened (read-only) \??\j: zbsfrcvs.exe File opened (read-only) \??\u: zbsfrcvs.exe File opened (read-only) \??\n: zbsfrcvs.exe File opened (read-only) \??\p: zbsfrcvs.exe File opened (read-only) \??\m: zbsfrcvs.exe File opened (read-only) \??\h: zbsfrcvs.exe File opened (read-only) \??\z: zbsfrcvs.exe File opened (read-only) \??\j: xledfkuyqo.exe File opened (read-only) \??\y: xledfkuyqo.exe File opened (read-only) \??\g: zbsfrcvs.exe File opened (read-only) \??\i: zbsfrcvs.exe File opened (read-only) \??\v: zbsfrcvs.exe File opened (read-only) \??\l: xledfkuyqo.exe File opened (read-only) \??\a: zbsfrcvs.exe File opened (read-only) \??\m: zbsfrcvs.exe File opened (read-only) \??\i: zbsfrcvs.exe File opened (read-only) \??\k: zbsfrcvs.exe File opened (read-only) \??\r: zbsfrcvs.exe File opened (read-only) \??\o: xledfkuyqo.exe File opened (read-only) \??\h: zbsfrcvs.exe File opened (read-only) \??\l: zbsfrcvs.exe File opened (read-only) \??\a: zbsfrcvs.exe File opened (read-only) \??\g: zbsfrcvs.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" xledfkuyqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" xledfkuyqo.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3644-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0008000000024502-5.dat autoit_exe behavioral1/files/0x001c0000000243fa-18.dat autoit_exe behavioral1/files/0x0007000000024508-32.dat autoit_exe behavioral1/files/0x0007000000024507-29.dat autoit_exe behavioral1/files/0x0004000000011943-67.dat autoit_exe behavioral1/files/0x000700000002451b-71.dat autoit_exe behavioral1/files/0x000400000001da56-92.dat autoit_exe behavioral1/files/0x000400000001da8b-98.dat autoit_exe behavioral1/files/0x000300000001da91-104.dat autoit_exe behavioral1/files/0x000600000001dabe-228.dat autoit_exe behavioral1/files/0x000600000001dabe-233.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nkyfqtqsnamzakf.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\zbsfrcvs.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\cjljdzcgtkeaw.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zbsfrcvs.exe File created C:\Windows\SysWOW64\xledfkuyqo.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\xledfkuyqo.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created C:\Windows\SysWOW64\nkyfqtqsnamzakf.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\zbsfrcvs.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\cjljdzcgtkeaw.exe 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll xledfkuyqo.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe zbsfrcvs.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zbsfrcvs.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zbsfrcvs.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zbsfrcvs.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zbsfrcvs.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zbsfrcvs.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zbsfrcvs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zbsfrcvs.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zbsfrcvs.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zbsfrcvs.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zbsfrcvs.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe zbsfrcvs.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe zbsfrcvs.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zbsfrcvs.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe zbsfrcvs.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe zbsfrcvs.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cjljdzcgtkeaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zbsfrcvs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xledfkuyqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nkyfqtqsnamzakf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zbsfrcvs.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32322C0F9C2C83206A4376A277232DD77C8F64D6" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7846BC2FF1B22A9D278D0A98A7D9063" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B1284494399D52CCBAD13393D4C5" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC77B15E5DAC4B8C97FE1EDE034CB" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" xledfkuyqo.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" xledfkuyqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc xledfkuyqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf xledfkuyqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs xledfkuyqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBFABFFE64F1E4840E3A45819A3E92B081028A43650233E1CF42EB08D3" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFF8D482C851B913CD62D7D96BD95E63659356742633FD6EA" 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg xledfkuyqo.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 744 WINWORD.EXE 744 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 2500 xledfkuyqo.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 4496 cjljdzcgtkeaw.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 4532 zbsfrcvs.exe 4532 zbsfrcvs.exe 4532 zbsfrcvs.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 3776 nkyfqtqsnamzakf.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 668 zbsfrcvs.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 2500 xledfkuyqo.exe 4496 cjljdzcgtkeaw.exe 4532 zbsfrcvs.exe 4532 zbsfrcvs.exe 4532 zbsfrcvs.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE 744 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3644 wrote to memory of 2500 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 83 PID 3644 wrote to memory of 3776 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 84 PID 3644 wrote to memory of 668 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 85 PID 3644 wrote to memory of 4496 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 86 PID 3644 wrote to memory of 744 3644 2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe 87 PID 2500 wrote to memory of 4532 2500 xledfkuyqo.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_83f503f3446b256c5e78006beb8bd207_elex_stop_yuner.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\xledfkuyqo.exexledfkuyqo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\zbsfrcvs.exeC:\Windows\system32\zbsfrcvs.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532
-
-
-
C:\Windows\SysWOW64\nkyfqtqsnamzakf.exenkyfqtqsnamzakf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3776
-
-
C:\Windows\SysWOW64\zbsfrcvs.exezbsfrcvs.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:668
-
-
C:\Windows\SysWOW64\cjljdzcgtkeaw.execjljdzcgtkeaw.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4496
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:744
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 fa58400a9d3a1d44f2684db3d1f562133d7de0eef2402b6f8cb376c913db0eed
- MD5 73260fa31c01d38cc6aae6e041d5f00d
- SHA1 d51db327d1957dd1275c0b9a68d162f3318c86e8
- SHA512 7d51efe28304266f5004871d867c92f8018bb40a7cba6e5118dd3438b7fae4684f0bbedb419fd6ff1ad803363783bc191b259bfd3e78289e18d3bc62bbd4edca
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T1E5B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 21a98da8f64cc6ca6a5531af3be351462207fda930ee14acb159431ca88831a4
- MD5 f239405eabc28471acd32e872adcbf76
- SHA1 51e73f09b0d8bf3f8a315d8e8c25ea93e56734ee
- SHA512 f683888b40fbb9617a8331579fb4c82ff1cd06cd28e4f4d4d72d9a0c474456b4a40717e9d7ec933193591e609582eda27f123f02eebd5b39b85d1f45e3733665
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj64:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- TLSH T1F3B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDB0B9.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\DismountUnlock\EnableAdd.doc.exe
- Size 512KB
- SHA256 a1d92e613569ac6aeefbe50fd56ff15479183f3a7bcaf521e37f73372e92f85a
- MD5 2e9475963cd86209e5c1b9664d0b2d9e
- SHA1 c83b406541c0ab1ca2caf50972071be738ea1421
- SHA512 5114dec729f43925d9bdc5e8a1bad6f3063820a90d22b5cd5f6ffce08ab791bfddca5075701c883c0405009b5b7470be3fa8007f6be4ca9d79cc8e1d78aee311
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- TLSH T1DEB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\DismountUnlock\UnprotectExpand.doc.exe
- Size 512KB
- SHA256 a2d198193d1995b83c48247cd40563d67c883ea5aec36ca706b9df1a44488455
- MD5 7bb5b3bb4f2fa8afa51d55ade9b5b3f4
- SHA1 cf8686797da60878a211ed1a1cfc40b5671ee32b
- SHA512 7e78426b52d516f3f4bb6b782dd963fdfd37248e527b3f430774aac69e26956e287710a12f3d18e1c6707f92e8b762a49fc1c44288089fbd249f9c34621ebbb8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- TLSH T130B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JoinGroup\DisableWait.doc.exe
- Size 512KB
- SHA256 88ae84e5b9976c536ef6fb115a3bb67566ea2a0417b55fa2397951e10578b3b6
- MD5 6d26356008b734576ba124f16164d7b2
- SHA1 e124f6075071dabec20f865bf5a36f29faaa069d
- SHA512 8464b015d39615701ae2726831420e3e3a8521bd2df6c345414fd0d1bb76ef9c978b860a8c6ae62bc136add6e609a34498a3dd6f297f8c537c26a7e9b45fd120
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T1B6B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 313B
- SHA256 40216f51cb9f1f1daf8de67133e02c9a43f075b9995906d9533d66a23aa5ffaf
- MD5 89f254cdbdc35fb4b0d371f804dde2bb
- SHA1 0c83ea55a8ed01c18fe5519aa38e80b10a94b6a3
- SHA512 23ef7be65fad82b06a4269a327a829ff8cdd386e23021fd58fc3ecf7701b121188fb0638d66ea57732f2ca73963b20f058a5200aacad1faca67386c6ddbfc4f9
- TLSH T1BDE0EC7B0760C7E0E37DD2F87670EEF91BF14098E16A117146C81C861C6055744D7648
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 3203755850b1c55a591f6b209029c3c16eff000ad7159699b1491d4e0d662354
- MD5 934ee018ca0f17c946559b0be7c9b732
- SHA1 5a5c24cc17d43f7452bd0f01955a4cb2f1da0123
- SHA512 fdbc4328d5f8c7595032b2a0c9c059bcfe7d2fa6b29ab3d57500b098f9f1923aa3d48ec4c553abdee3113f3c168ba82b1524641c67de449fce37fff769d4e41a
- TLSH T16221DD0256A75FD9E018C337D13A5B11DB31BD43DA5E8B0FA284B11A6DB1E005F2E77A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 687B
- SHA256 b1e1d83d6639967da814c273b92cbdf6283fd3476a369c36dfd281323f467b3f
- MD5 192d54bfb70cc5d1e9841499b8492e39
- SHA1 5b7cdc33f7d98f0eee1782725f64363270b885fa
- SHA512 3a49cff74d8b6d2d6fc7fd14add5bac535b2a905d76aca9e302911bc060d3edc40362eecd7cab5b51d099f1eaec9a68715342040a300560e317456c4e7fb5bd4
- TLSH T14D01E1026A971F89F054C37792394701C731BE42D69E930D92C4A02A6CB1E005B59B7A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\cjljdzcgtkeaw.exe
- Size 512KB
- SHA256 260300a2ce0be43fb814c772440edb7ce37144a7dd9a3385fa7190827be62e19
- MD5 b21289119c6badead12858cffeecc605
- SHA1 2daa0b8e7ec1044dfde62af02e1e6e0a83d6bc4f
- SHA512 63e60a0d13542f1f8e04836163055f2f533bc7fbda92b64d12159c36eedeec1d45dc1b932c16d5a14e920b1e23bf9b92888e2f2268d78e39e1ce3fa2f71439b2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- TLSH T1C5B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nkyfqtqsnamzakf.exe
- Size 512KB
- SHA256 c45eed8c5cbad9740bd9fd42c9314402dc296b4626e75538c9b6c23a7aefd4e1
- MD5 59816b03c2ec192f8f66dedf476e5956
- SHA1 53da6f77232d91423eb50a6a114ff4956cff4d85
- SHA512 ebb8d35d1a93ecc1d04403a9b3325623301ee241f2aa4f0f00b511e0808adda4a5a9a7b6b691459754dba1c0867a9d2f183c2bab5f8a562730c7e8f2dcecee52
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- TLSH T109B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xledfkuyqo.exe
- Size 512KB
- SHA256 b52024b048ff5549e15682a5171d840d947a70c8229c2bd50b622ada0fba3e07
- MD5 7f0044d8018f6c8b28dab574ca188426
- SHA1 bba0a82093b9a9c315177ffe5facd34e345c5011
- SHA512 9076fb78e53d323b2458b75b5cd6a8c2406bce4970e25c4a908e976e705edee74df6d02d41cf519919eb425d137640078bf962a55af7dc3a43fa77b7fff45e73
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- TLSH T15FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\zbsfrcvs.exe
- Size 512KB
- SHA256 e34a008f04d65b136608e98b0e5c81b5dc9f6fa1d73cb631a787a17d9c50822b
- MD5 3e3b5be8637a840ea6ca5ccdef9569ee
- SHA1 3893402e7b84c87b4fbecd566bdf464dfdfadc55
- SHA512 f9c999532d14198527b1cedbda4a11fbd12508fdbc16c1be57b05216f4f4b661036c37660818355a7c7baa9d6e626406545c327f02c39f266fe4c9a21e54cec1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T1BFB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 b142d55d7b7e18bf19d6d9e9b4e0ff68adec18ec12f5eee45d36a7999fcf0bf2
- MD5 65e4daf398fdef7b1d1ba4f873a387b8
- SHA1 f687555769f5a444ad19941d14e71a3c8d7f2689
- SHA512 bf2c71395bda1adcfc68d2a0b9c265799b1cdafb5ae66fcf7c13ca750adb0da4d1338577726acc223cd482201695d5cc89ea3fe907d84a73f5461410e3df21f2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
- TLSH T111B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 a38e2e8b4bb80b6c49dec2395fb42eca10afc3ea14036a28d0595385f9183c4e
- MD5 cd0507d3815c79774c271c8476ee9dd5
- SHA1 269a06726f6692b09e062b83f6f1b695822d11d1
- SHA512 f13e26bee8f714bf95e87b5c26185cb06cd21a8772bc1f95aaefbc7f4e300432afc89247ee33b0c933a5f6e9b6f824c95ccb64ebdad0062bb92a37534d48ebc8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- TLSH T189B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH