Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 01:07
Behavioral task
behavioral1
Sample
2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe
- Size 512KB
- Sample260826-bgrcta1djd
- SHA256 bcb4e5b024a6df9c02851f361785345f132bb5d779c692bcae520eace2241f0f
- MD5 f907594f25c94824a2a6700226337143
- SHA1 7ea5bbbf747900719b9e83706ba3194a0e62ab15
- SHA512 3b3313431aec96a6c48b5a5c03649720337a0d818fb641e01b47bbea21128e56adfe484f4b96fcd8d179c6c8f8f8c5c1815f5e82e995792a3f445a4996b2a599
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q
- TLSH T1A8B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 13 IoCs
resource yara_rule behavioral2/files/0x001000000001c545-5.dat family_sohanad behavioral2/files/0x0006000000016b3a-11.dat family_sohanad behavioral2/files/0x001b00000001c511-17.dat family_sohanad behavioral2/files/0x000e00000001c550-26.dat family_sohanad behavioral2/files/0x000d00000001c569-64.dat family_sohanad behavioral2/files/0x000d00000001c56a-67.dat family_sohanad behavioral2/files/0x000d00000001c56b-70.dat family_sohanad behavioral2/files/0x000d00000001c56c-73.dat family_sohanad behavioral2/files/0x000d00000001c56d-76.dat family_sohanad behavioral2/files/0x000d00000001c56e-80.dat family_sohanad behavioral2/files/0x000d00000001c56f-83.dat family_sohanad behavioral2/files/0x001b00000001c5a0-439.dat family_sohanad behavioral2/files/0x001b00000001c5a0-441.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fqgwnxmajh.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fqgwnxmajh.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fqgwnxmajh.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fqgwnxmajh.exe - Executes dropped EXE 5 IoCs
pid Process 4124 fqgwnxmajh.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 1940 gtgrhkkkfldzo.exe 5184 crpqmpgd.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fqgwnxmajh.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rlwenfic = "zzrvohrzyhiplig.exe" zzrvohrzyhiplig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gtgrhkkkfldzo.exe" zzrvohrzyhiplig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfcubmws = "fqgwnxmajh.exe" zzrvohrzyhiplig.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: fqgwnxmajh.exe File opened (read-only) \??\z: crpqmpgd.exe File opened (read-only) \??\d: crpqmpgd.exe File opened (read-only) \??\d: fqgwnxmajh.exe File opened (read-only) \??\b: crpqmpgd.exe File opened (read-only) \??\y: crpqmpgd.exe File opened (read-only) \??\a: crpqmpgd.exe File opened (read-only) \??\j: fqgwnxmajh.exe File opened (read-only) \??\h: crpqmpgd.exe File opened (read-only) \??\u: crpqmpgd.exe File opened (read-only) \??\i: crpqmpgd.exe File opened (read-only) \??\x: fqgwnxmajh.exe File opened (read-only) \??\g: crpqmpgd.exe File opened (read-only) \??\q: crpqmpgd.exe File opened (read-only) \??\l: crpqmpgd.exe File opened (read-only) \??\m: crpqmpgd.exe File opened (read-only) \??\r: crpqmpgd.exe File opened (read-only) \??\b: fqgwnxmajh.exe File opened (read-only) \??\p: fqgwnxmajh.exe File opened (read-only) \??\w: crpqmpgd.exe File opened (read-only) \??\n: fqgwnxmajh.exe File opened (read-only) \??\s: fqgwnxmajh.exe File opened (read-only) \??\a: crpqmpgd.exe File opened (read-only) \??\n: crpqmpgd.exe File opened (read-only) \??\t: crpqmpgd.exe File opened (read-only) \??\t: fqgwnxmajh.exe File opened (read-only) \??\h: crpqmpgd.exe File opened (read-only) \??\n: crpqmpgd.exe File opened (read-only) \??\s: crpqmpgd.exe File opened (read-only) \??\a: fqgwnxmajh.exe File opened (read-only) \??\p: crpqmpgd.exe File opened (read-only) \??\i: crpqmpgd.exe File opened (read-only) \??\k: crpqmpgd.exe File opened (read-only) \??\h: fqgwnxmajh.exe File opened (read-only) \??\v: crpqmpgd.exe File opened (read-only) \??\z: crpqmpgd.exe File opened (read-only) \??\s: crpqmpgd.exe File opened (read-only) \??\u: crpqmpgd.exe File opened (read-only) \??\r: fqgwnxmajh.exe File opened (read-only) \??\z: fqgwnxmajh.exe File opened (read-only) \??\v: crpqmpgd.exe File opened (read-only) \??\o: crpqmpgd.exe File opened (read-only) \??\w: crpqmpgd.exe File opened (read-only) \??\g: fqgwnxmajh.exe File opened (read-only) \??\u: fqgwnxmajh.exe File opened (read-only) \??\y: fqgwnxmajh.exe File opened (read-only) \??\y: crpqmpgd.exe File opened (read-only) \??\m: fqgwnxmajh.exe File opened (read-only) \??\j: crpqmpgd.exe File opened (read-only) \??\l: crpqmpgd.exe File opened (read-only) \??\o: crpqmpgd.exe File opened (read-only) \??\d: crpqmpgd.exe File opened (read-only) \??\r: crpqmpgd.exe File opened (read-only) \??\x: crpqmpgd.exe File opened (read-only) \??\l: fqgwnxmajh.exe File opened (read-only) \??\q: fqgwnxmajh.exe File opened (read-only) \??\b: crpqmpgd.exe File opened (read-only) \??\k: fqgwnxmajh.exe File opened (read-only) \??\w: fqgwnxmajh.exe File opened (read-only) \??\m: crpqmpgd.exe File opened (read-only) \??\j: crpqmpgd.exe File opened (read-only) \??\p: crpqmpgd.exe File opened (read-only) \??\t: crpqmpgd.exe File opened (read-only) \??\i: fqgwnxmajh.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fqgwnxmajh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fqgwnxmajh.exe - AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3600-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001000000001c545-5.dat autoit_exe behavioral2/files/0x0006000000016b3a-11.dat autoit_exe behavioral2/files/0x001b00000001c511-17.dat autoit_exe behavioral2/files/0x000e00000001c550-26.dat autoit_exe behavioral2/files/0x000d00000001c569-64.dat autoit_exe behavioral2/files/0x000d00000001c56a-67.dat autoit_exe behavioral2/files/0x000d00000001c56b-70.dat autoit_exe behavioral2/files/0x000d00000001c56c-73.dat autoit_exe behavioral2/files/0x000d00000001c56d-76.dat autoit_exe behavioral2/files/0x000d00000001c56e-80.dat autoit_exe behavioral2/files/0x000d00000001c56f-83.dat autoit_exe behavioral2/files/0x001b00000001c5a0-439.dat autoit_exe behavioral2/files/0x001b00000001c5a0-441.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\crpqmpgd.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe crpqmpgd.exe File created C:\Windows\SysWOW64\fqgwnxmajh.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File created C:\Windows\SysWOW64\zzrvohrzyhiplig.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File created C:\Windows\SysWOW64\gtgrhkkkfldzo.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\gtgrhkkkfldzo.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fqgwnxmajh.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification C:\Windows\SysWOW64\fqgwnxmajh.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\zzrvohrzyhiplig.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File created C:\Windows\SysWOW64\crpqmpgd.exe 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal crpqmpgd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe crpqmpgd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal crpqmpgd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe crpqmpgd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe crpqmpgd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe crpqmpgd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal crpqmpgd.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe crpqmpgd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe crpqmpgd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe crpqmpgd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe crpqmpgd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fqgwnxmajh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zzrvohrzyhiplig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crpqmpgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gtgrhkkkfldzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crpqmpgd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fqgwnxmajh.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C67D14E5DABEB8CA7CE2ED9734CA" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fqgwnxmajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9BEFE16F2E4837F3B3281993EE2B3FD02FC43610239E1B942E908D4" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F26BB3FE6722DDD272D0A38B7E9010" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fqgwnxmajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fqgwnxmajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fqgwnxmajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fqgwnxmajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452D799C5582586A3277A770542CDF7D8464A8" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02844EE38E353BAB9D23292D7BB" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFC83482782139130D72C7DE5BDE6E134594B67436234D79B" 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fqgwnxmajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fqgwnxmajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fqgwnxmajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fqgwnxmajh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fqgwnxmajh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fqgwnxmajh.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1296 WINWORD.EXE 1296 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 5184 crpqmpgd.exe 5184 crpqmpgd.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 5184 crpqmpgd.exe 5184 crpqmpgd.exe 5184 crpqmpgd.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 4512 zzrvohrzyhiplig.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 3288 crpqmpgd.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 4124 fqgwnxmajh.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 1940 gtgrhkkkfldzo.exe 5184 crpqmpgd.exe 5184 crpqmpgd.exe 5184 crpqmpgd.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE 1296 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3600 wrote to memory of 4124 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 89 PID 3600 wrote to memory of 4512 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 90 PID 3600 wrote to memory of 3288 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 91 PID 3600 wrote to memory of 1940 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 92 PID 3600 wrote to memory of 1296 3600 2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe 93 PID 4124 wrote to memory of 5184 4124 fqgwnxmajh.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_f907594f25c94824a2a6700226337143_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\fqgwnxmajh.exefqgwnxmajh.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\crpqmpgd.exeC:\Windows\system32\crpqmpgd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5184
-
-
-
C:\Windows\SysWOW64\zzrvohrzyhiplig.exezzrvohrzyhiplig.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4512
-
-
C:\Windows\SysWOW64\crpqmpgd.execrpqmpgd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3288
-
-
C:\Windows\SysWOW64\gtgrhkkkfldzo.exegtgrhkkkfldzo.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1940
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1296
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 dbfdf52a41e6a3ea3939a3e14287a96035c45e20897ce339bfe43eb9ceb47bdf
- MD5 ad08328ed5b5ca750f83d829af1f2e61
- SHA1 af40fd7b51ec16c9729cd7b857026857f509957e
- SHA512 15e0be305aa4ef3afe613ecf6334dceada48fd11d03f92a9df1763cf996338e888e217e152c3f8659b700202efb02a24160eff48c360cb5e3f7d77a69b4366dc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- TLSH T104B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 950aaff95db743f41eedf9876b00d446fb8bbc60ece79738211d8248f393eb16
- MD5 f5acde0e54953e86d3dff7799cb50386
- SHA1 4953fa184756edb679c5f57c7a0e506d6eb93946
- SHA512 b014669195e7b45267fcc0416e4bb6be47d5b0b6f19f34bdc791432ea1d8976baf4521028e75de02738df2a4111bb6c67100e60d4a078440f9d93c0f5fc82254
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- TLSH T16BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD1D77.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ClearMount\UseCompare.doc.exe
- Size 512KB
- SHA256 8a58544312fc8c5f52b3621b2a9b86c63a6c429d541e326349011147218c3bdb
- MD5 3eee493ccd5363a1bc0422e8840c0799
- SHA1 d6f1748af8cfef50638c75e18a3a4e8358420653
- SHA512 29c8b79a7502dac539bd37cdaf5852354d185de9309e5c59c328e61fa354c14ae62ebb709025617e37e29d8a9cb2f6df1d071e3129d80a7c4fde1c601431c9b9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- TLSH T1E7B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ConnectTest\ApproveMove.doc.exe
- Size 512KB
- SHA256 43a8e8d21a04aecded467dda385c934fb30f99321a3abf67bfb2ef0778e974e3
- MD5 6c829ccb3d762312fae374be85272a81
- SHA1 305351d1755ecd46f6f228686d8a217778e5fa82
- SHA512 5d4f0df88e8a0fc1ac18f7fd5b6561ba46ca700b64dc759e822923daa0a4294dfc5f3c4b24d5f254cb78de3f510029c478a3962518437a3ad8e606eed21c1518
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- TLSH T1FAB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 387B
- SHA256 174dc745cb17918b50097622228871ddc665898e2ce812ce535f0fcd32fe2f8d
- MD5 1d2a7450485218ecf1a4172a6c36a43b
- SHA1 12e4be06052a33f065f7450e5fbe99b16833c087
- SHA512 2748aa31f982f5eb2a039c73c799a9d4f2186d647835ac6d074fd3be0e6113b93b8c41694b12eb9c9f7c918656e65b398f722ef675422b92eebbcdeb015846a9
- TLSH T127E0EEAB3314F3F043BE81E4387C5DE0ABF25C44FBAA02215ACC0CA92E605C3616B54D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 85df420c2146473ce97740f9ad8d5d17926768a6441d6357c58d99e5e4a69c58
- MD5 9d8b15872b428ec53a2eb023c353aadf
- SHA1 e691cf178d973fc7b22617e2bcc50d313b185fb5
- SHA512 fcf2c1fa33efa94bc5f5ae94d4dad32f840f8e825be23e5d70ee74e840d8207b8b7b678b58dbe9524110f0d43c5880a7057bf01c126ed0d652f2781ea110614e
- TLSH T1A571CF02169F6B9BE095437B172F4319D3307C42F9509B5E9688322F6D34EA06E8CB2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 4KB
- SHA256 26285c0f249abcdea39ae48b8803b6e3da529360cdfbc9c83169e162242aefaf
- MD5 bf1ec526027b5b08f412b9d246157d2f
- SHA1 cc20b425c6d14c511408afae0a405cf5b670f544
- SHA512 9059d4ce192af3a8d6a9c48a44ca186105eff8787a97dbfcc140216938cdb09c7940bbf224b932418e8a76ddb57baeb586ebc75764a54b903fec5ccdf4c37319
- SSDEEP 96:Uh7pO0wmXQWR9tZB0wetFpnRObUhRjvCQS0wQn2aT:Uh7ggXf9tTgt9OWjxS7+
- TLSH T1AB91CD02069F6B9BE099433B172F5315D3307D42FA519B5E5648322F7D74EA06E8CB2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RepairSwitch\SubmitApprove.doc.exe
- Size 512KB
- SHA256 7aa1dbbc27b35a97901fad5d7614315a01832ec6ae2f9da443847730da9212cf
- MD5 c834c7b202521e8497858b236c0ed3f7
- SHA1 a84366188f6031c5f4b9bf8d4579929d353adcc1
- SHA512 c3c7c4f55f338ad2606e4526753c740e2ded7902952cc8b99d69c01a57b3a5b33a4658d95a6d13a118cd32bc862ccd529d671401d09e67a66801d03aef861b1d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- TLSH T1D4B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\WaitClear.doc.exe
- Size 512KB
- SHA256 fdd74ebdf37d7df5a24315a99a8203708869b281a11ddf9baf06af19830cbe94
- MD5 93290d7b2caeb9a30a6c19c7c2799a46
- SHA1 218b327557a2187621c54678db946844a880feff
- SHA512 4e397b7fdea7dcebb928a349caae81496b03ce9151c69ff4d05957de694faf815e8d7350bdb243937499d972590eb8404e13f1bb6bce2aff643b9c5614f4ab8a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S
- TLSH T15BB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\crpqmpgd.exe
- Size 512KB
- SHA256 10ac9c8aadc9817af8dfaa2e37971026f26ab98b6ca42e36733c61f5e28bf384
- MD5 f20a7455c456f19b4eae24f8e0255329
- SHA1 2f3b440a668fcc1997ca2053a59d7032f8d1daa1
- SHA512 13110d9dc098e992bbb97385ccec4c0d741c7956149bb6a15372a58d30e8404c42e092102b79c37f0f6c610b28aff762f545eae2f726fc1b1877441e84046df4
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- TLSH T1BAB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\fqgwnxmajh.exe
- Size 512KB
- SHA256 5b95d32081740aea9e2c2dc21e159d6f39598883cf2cde94e280ed4af992b24d
- MD5 dd82192fdf3b9f146a259d58a91f60bb
- SHA1 9983d8cf10581ce6be777af70a2cb5546d7997ac
- SHA512 57f482c327304f03b31d490e28930870b0a50fb868c85cb537343f4b4420140c54ff4f4a40f78469edbffb149e8f759386ca3b3bb7b0c56b9a592821866911a0
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- TLSH T176B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\gtgrhkkkfldzo.exe
- Size 512KB
- SHA256 d2e3fe43b1d39fc68d2977e7c9a3c960a36d3bbd8aa757ccd3cf2ef1e06dcefe
- MD5 54c6bfdd1d45cdc2f5ec1dfce1d8ed79
- SHA1 8d5ebd5ba8d4b12f2a01c956ed4c2099a71db043
- SHA512 c071692fd8ee4c3870a608fd8461cde87be98083152d094d3d9cad01375ad0f9e6d7f9a42d450b280ae74016b2e7477193cf394542ac0ed9f2aabcb66a452d24
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T13CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\zzrvohrzyhiplig.exe
- Size 512KB
- SHA256 ff78ee328ee2d5b8176cfa5a27316b5704cdc1adfa9693d56d0e497fc94c5388
- MD5 54977808a73881a90d4dc67d5a831461
- SHA1 295ebed0259f32e2a52e402e34405728df6236b8
- SHA512 f0adfb3a70b4cfb98d7e82bf2f2e29a24a6c0f249ffd8ee277eaed9f073f1b594b7d673fec4993da86292bbfc71c0bf8e61e9e795cea8d76858d668b9fc44fe1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T1F6B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\Desktop\ReceiveRedo.doc.exe
- Size 512KB
- SHA256 a79a218d57794282109bc1fbdb4ade3964776084a83a621eb76c8a404903897a
- MD5 823bff0d325784838054de13e115d7ce
- SHA1 6719c930e1325ba4e5262a058f71173a9361d36d
- SHA512 935b4d3d92db9d64b2d60401dcefede1b1f8f080e04a68e13a22ff20c2f7efd15d4dc16be8ca68951f1bfa903c2301a811fe75b4753e0b70fb2efdf6544a97dc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5s
- TLSH T18EB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 e2a6f501f9839da5615193f6484ee7a9bc2d78028d672933719f94bdcc6497d1
- MD5 f666ff562d95de68fb79f7b4ec4f13d3
- SHA1 f76fec6ff04c948af1fdbf26534feaad627b6ea2
- SHA512 21b18cf4ab302963cf2077c1ab1b6a9ff71ebebd7ab95d6dc49f650d609966e6578cf0425a78ae0ff36f7dd3a072b9f037146ff9d4340361825af0b1cc52b0ea
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- TLSH T179B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 ed4b96f9cf07aadb079eb37a815fd5fc178a4a66a32b0b3e2fc27d99e5037a75
- MD5 c251f79091a165edaa1eeeca039f31ea
- SHA1 1c2429630dae36885875d3617a284dcf2f645bc8
- SHA512 e2b222b67ae16d42c87effe33754f4c19cdface4a61c4d935133ad389d3e6aec1c562fb16dee50e091df6bebeb665b53092c1022dd418bd5778aafa566966c7b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O
- TLSH T155B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH