Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 13:59
Behavioral task
behavioral1
Sample
2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
- Size 514KB
- Sample260417-ragg2aa17w
- SHA256 133ce56459c69089791ff32e9738e7225fde2f71d87f54f0b24390dc28e3de43
- MD5 5c81c558cf8c82dcb91c03b34abe1dc7
- SHA1 9c81829663d103b17c58b03e2d93567ac667bb88
- SHA512 a54f85bdf92704ca6f32390fbaf5d0f67eefb1e08ad601825f7ce8caece7f8bf4e17c1e4eae3fcf38117d0aed58d8b9cea5f4c20ce51883bc9edab4fd701a20b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T155B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral1/files/0x000800000002410a-5.dat family_sohanad behavioral1/files/0x000600000002274c-19.dat family_sohanad behavioral1/files/0x000800000002410c-32.dat family_sohanad behavioral1/files/0x000800000002410b-28.dat family_sohanad behavioral1/files/0x0002000000023015-63.dat family_sohanad behavioral1/files/0x00080000000241cc-67.dat family_sohanad behavioral1/files/0x000300000001e723-77.dat family_sohanad behavioral1/files/0x0007000000024292-98.dat family_sohanad behavioral1/files/0x0007000000024292-100.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tfjpmmgkrz.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tfjpmmgkrz.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tfjpmmgkrz.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tfjpmmgkrz.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe - Executes dropped EXE 5 IoCs
pid Process 3908 tfjpmmgkrz.exe 2052 cuedbcwvfpqacdh.exe 1172 bxrrqoiw.exe 3732 biunatboyzxds.exe 3092 bxrrqoiw.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tfjpmmgkrz.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vpizijua = "tfjpmmgkrz.exe" cuedbcwvfpqacdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ejtcover = "cuedbcwvfpqacdh.exe" cuedbcwvfpqacdh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "biunatboyzxds.exe" cuedbcwvfpqacdh.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: bxrrqoiw.exe File opened (read-only) \??\p: bxrrqoiw.exe File opened (read-only) \??\o: tfjpmmgkrz.exe File opened (read-only) \??\g: bxrrqoiw.exe File opened (read-only) \??\z: bxrrqoiw.exe File opened (read-only) \??\i: bxrrqoiw.exe File opened (read-only) \??\t: bxrrqoiw.exe File opened (read-only) \??\z: bxrrqoiw.exe File opened (read-only) \??\a: tfjpmmgkrz.exe File opened (read-only) \??\x: tfjpmmgkrz.exe File opened (read-only) \??\k: bxrrqoiw.exe File opened (read-only) \??\h: bxrrqoiw.exe File opened (read-only) \??\v: bxrrqoiw.exe File opened (read-only) \??\u: tfjpmmgkrz.exe File opened (read-only) \??\n: bxrrqoiw.exe File opened (read-only) \??\p: bxrrqoiw.exe File opened (read-only) \??\a: bxrrqoiw.exe File opened (read-only) \??\e: bxrrqoiw.exe File opened (read-only) \??\e: tfjpmmgkrz.exe File opened (read-only) \??\l: tfjpmmgkrz.exe File opened (read-only) \??\m: tfjpmmgkrz.exe File opened (read-only) \??\v: tfjpmmgkrz.exe File opened (read-only) \??\j: bxrrqoiw.exe File opened (read-only) \??\s: bxrrqoiw.exe File opened (read-only) \??\r: bxrrqoiw.exe File opened (read-only) \??\x: bxrrqoiw.exe File opened (read-only) \??\m: bxrrqoiw.exe File opened (read-only) \??\u: bxrrqoiw.exe File opened (read-only) \??\w: bxrrqoiw.exe File opened (read-only) \??\q: tfjpmmgkrz.exe File opened (read-only) \??\t: tfjpmmgkrz.exe File opened (read-only) \??\a: bxrrqoiw.exe File opened (read-only) \??\e: bxrrqoiw.exe File opened (read-only) \??\s: bxrrqoiw.exe File opened (read-only) \??\b: bxrrqoiw.exe File opened (read-only) \??\k: bxrrqoiw.exe File opened (read-only) \??\p: tfjpmmgkrz.exe File opened (read-only) \??\t: bxrrqoiw.exe File opened (read-only) \??\w: bxrrqoiw.exe File opened (read-only) \??\b: tfjpmmgkrz.exe File opened (read-only) \??\z: tfjpmmgkrz.exe File opened (read-only) \??\j: bxrrqoiw.exe File opened (read-only) \??\k: tfjpmmgkrz.exe File opened (read-only) \??\r: tfjpmmgkrz.exe File opened (read-only) \??\l: bxrrqoiw.exe File opened (read-only) \??\o: bxrrqoiw.exe File opened (read-only) \??\q: bxrrqoiw.exe File opened (read-only) \??\y: bxrrqoiw.exe File opened (read-only) \??\g: tfjpmmgkrz.exe File opened (read-only) \??\q: bxrrqoiw.exe File opened (read-only) \??\g: bxrrqoiw.exe File opened (read-only) \??\x: bxrrqoiw.exe File opened (read-only) \??\n: tfjpmmgkrz.exe File opened (read-only) \??\y: bxrrqoiw.exe File opened (read-only) \??\r: bxrrqoiw.exe File opened (read-only) \??\l: bxrrqoiw.exe File opened (read-only) \??\i: bxrrqoiw.exe File opened (read-only) \??\b: bxrrqoiw.exe File opened (read-only) \??\j: tfjpmmgkrz.exe File opened (read-only) \??\y: tfjpmmgkrz.exe File opened (read-only) \??\h: bxrrqoiw.exe File opened (read-only) \??\h: tfjpmmgkrz.exe File opened (read-only) \??\m: bxrrqoiw.exe File opened (read-only) \??\n: bxrrqoiw.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tfjpmmgkrz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tfjpmmgkrz.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/5048-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000800000002410a-5.dat autoit_exe behavioral1/files/0x000600000002274c-19.dat autoit_exe behavioral1/files/0x000800000002410c-32.dat autoit_exe behavioral1/files/0x000800000002410b-28.dat autoit_exe behavioral1/files/0x0002000000023015-63.dat autoit_exe behavioral1/files/0x00080000000241cc-67.dat autoit_exe behavioral1/files/0x000300000001e723-77.dat autoit_exe behavioral1/files/0x0007000000024292-98.dat autoit_exe behavioral1/files/0x0007000000024292-100.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bxrrqoiw.exe File created C:\Windows\SysWOW64\tfjpmmgkrz.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\tfjpmmgkrz.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\cuedbcwvfpqacdh.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\cuedbcwvfpqacdh.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\bxrrqoiw.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\biunatboyzxds.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification C:\Windows\SysWOW64\bxrrqoiw.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\biunatboyzxds.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tfjpmmgkrz.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bxrrqoiw.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bxrrqoiw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bxrrqoiw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bxrrqoiw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bxrrqoiw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bxrrqoiw.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification C:\Windows\mydoc.rtf 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe bxrrqoiw.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bxrrqoiw.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bxrrqoiw.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bxrrqoiw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cuedbcwvfpqacdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxrrqoiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language biunatboyzxds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxrrqoiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfjpmmgkrz.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tfjpmmgkrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tfjpmmgkrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C7E9C2382246A3176DD70212CAE7CF565AA" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDF9B1F913F1E2830B3B42819C3E97B089038D42690338E1CD429D08A2" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B05B4497389952CFBADD329CD4BE" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FF8E4F5C851F9140D6587D97BDE2E6405836664F6343D6EE" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F768B5FE6D22A9D279D0A48B7C916B" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tfjpmmgkrz.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1845C67B14E6DAC3B8CB7FE2EDE237CB" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tfjpmmgkrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tfjpmmgkrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tfjpmmgkrz.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 724 WINWORD.EXE 724 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 3908 tfjpmmgkrz.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 1172 bxrrqoiw.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 2052 cuedbcwvfpqacdh.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3092 bxrrqoiw.exe 3092 bxrrqoiw.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3908 tfjpmmgkrz.exe 2052 cuedbcwvfpqacdh.exe 3908 tfjpmmgkrz.exe 1172 bxrrqoiw.exe 2052 cuedbcwvfpqacdh.exe 3908 tfjpmmgkrz.exe 3732 biunatboyzxds.exe 1172 bxrrqoiw.exe 2052 cuedbcwvfpqacdh.exe 1172 bxrrqoiw.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3092 bxrrqoiw.exe 3092 bxrrqoiw.exe 3092 bxrrqoiw.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3908 tfjpmmgkrz.exe 2052 cuedbcwvfpqacdh.exe 3908 tfjpmmgkrz.exe 1172 bxrrqoiw.exe 2052 cuedbcwvfpqacdh.exe 3908 tfjpmmgkrz.exe 1172 bxrrqoiw.exe 3732 biunatboyzxds.exe 2052 cuedbcwvfpqacdh.exe 1172 bxrrqoiw.exe 3732 biunatboyzxds.exe 3732 biunatboyzxds.exe 3092 bxrrqoiw.exe 3092 bxrrqoiw.exe 3092 bxrrqoiw.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE 724 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3908 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 84 PID 5048 wrote to memory of 2052 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 85 PID 5048 wrote to memory of 1172 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 86 PID 5048 wrote to memory of 3732 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 87 PID 5048 wrote to memory of 724 5048 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 88 PID 3908 wrote to memory of 3092 3908 tfjpmmgkrz.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\tfjpmmgkrz.exetfjpmmgkrz.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\bxrrqoiw.exeC:\Windows\system32\bxrrqoiw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3092
-
-
-
C:\Windows\SysWOW64\cuedbcwvfpqacdh.execuedbcwvfpqacdh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2052
-
-
C:\Windows\SysWOW64\bxrrqoiw.exebxrrqoiw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1172
-
-
C:\Windows\SysWOW64\biunatboyzxds.exebiunatboyzxds.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3732
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:724
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 514KB
- SHA256 98f58b2cf229f95c855ea0d7412663bedd9d2db275a19142eabd4a0c2a80995b
- MD5 9639b791b088eb5e17b04c8133e10fad
- SHA1 8e36df724b26bdc47a1bc02ed276493b91d01ff4
- SHA512 38a6b7f608455e2807102fda686e54a90f2a2fd42501164ac333341210e8562bd18734b678faedd98a980aeaaddea3e48c2a25ad1e213cb79c000c0ddc195544
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- TLSH T196B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 514KB
- SHA256 d893dc92aac9c8b34186e64fed38db413ad510156279f64b848132d5f25479fd
- MD5 d0c7d85cf1913b54210d8596efe5ff64
- SHA1 eacbf2b23b6b5858b59c31fcbaac7f4cf9646490
- SHA512 360dd113d5311ed878f1b98d279ddfe9c0a065369b26a33e43581f7900fd8f7b6d261e6499d902a557a6323f3c45048a86932a7ab30fab1a6d8d322f3fbd1faf
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- TLSH T1D0B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 351B
- SHA256 fdf7eb03f125dac602f35b1fb0059ec3aa3766edcf28e9a7d1caefc85083d64a
- MD5 0a27b631d0b4ede22b095dbc12a08fbc
- SHA1 92f2be550a176e1810f43ee27cff3d5c10fd1231
- SHA512 ec12bb06495762b3db9df17e599b88d3ae77dc5bc12a516df293f2303e463fa66d8a9bfcf5e54636d7bf2c0f370556d1dfd5f8ab4908817c11ebc0d1a309f22f
- TLSH T105E0ECA7F352EBF0837C12983C396CE55BF28C18D6AA513167CC1C861DB0583219B21D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 dcf404ca47a4c51e5370ddac1e06fc98e01fb13d953cc2d8246c92bc87a4dc43
- MD5 f520ef65c9359b2dcb1b6d2832aaa9ea
- SHA1 38fa09d58c5ec497d5b78ed56f92e9bf9268f62b
- SHA512 f1aeb654112ad927722b3fb64e5c2c3164b14ba92ce24accd26b6114aa5ab65ba8619eb2b66dabd6e554539cac74609996bb8cc5b18e91b2fd4ea36129320a08
- TLSH T16961DE0157DF2F5FD082433295368B59D7307CC6A224A20F67C4953A6FB1D006E9EF6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 fbe4bd3c48c596ce6f4e59534cc5d41cde30e3ddba3d83ab646109beccda0537
- MD5 8cd101c85758a493f84c0ab27c007469
- SHA1 2b09e1f8a3e0f13eb8a73cc5c53ab66bc7071d2d
- SHA512 dab3a8471df5ccb03a956d8b211d8f5757b935fcfb976cf42f15bc99d42430c427198a3d178c8d1b1ce035005c6de819112cd9548221324e6397bde0da346a66
- TLSH T100810F0157DB1F8FD09243329536CB59D7307C86E224B60F57C4A63A6FB1E006E8EB6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\UpdateEdit\EnableGet.doc.exe
- Size 514KB
- SHA256 5935189d899e65d7a6efe45c419445840ba66c6a023170546c4a06938085ba2d
- MD5 9fbdf04a60a08c928b08c02e2b1b1cad
- SHA1 302a24b27c1be5ac89db64c21c2445ab7af7c0f6
- SHA512 e36d76db6031dcbf5200f39649b6db33ba46746b69f36a7409ffacdea1201310e67674649d042c99799111c5f09f2572d2188c9d1857713cd94cf87bd19ac3d3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- TLSH T17FB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\biunatboyzxds.exe
- Size 514KB
- SHA256 521dba427203924040dccc20b58957b8fe8bb8963b07c6525ea7432354710170
- MD5 e0f59b011e0b4061046837c688b81be5
- SHA1 b5dfa9ce1cca321b5b7bd3d9cc54084aad115b04
- SHA512 e63b31184b1e952068db7f7d62f0ed7d5d3c29a059dbc09e774f76152db54470b30e28f54cbb30b93409310f9f52a744054eac81573e689a4c6a012fffc3f985
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T1E8B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bxrrqoiw.exe
- Size 514KB
- SHA256 bc14e890df74d8d7cf8bb2dcb7aa7d0163d43dd26c9eb049b5acc766938d2878
- MD5 6459cf2a706d804d0412673b6a0d0892
- SHA1 4ce3da64463f5cc9b518ac75f5e13438bc728937
- SHA512 c714fd1547409d2adcb23122719e0a90773c6c92d08bbce191ddeb0d0fa9302a3700799683d84cad1c73a8316887ac0045edb36dbf3beae2b14e39a2f023c1d5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- TLSH T17CB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\cuedbcwvfpqacdh.exe
- Size 514KB
- SHA256 e08350b2b9def912f09feeb0c44e01a64407b087a7ffe6b7931e0a5ebe2587cf
- MD5 cc4c5df4597510bdb76b412e9d6b96b6
- SHA1 66163a6ab86678554a166d3f81fa6e12a71c4207
- SHA512 c74f2138e312b2560f90ba701f66c3a45ffa451948f35d070572f52d3b339e9bbbbb513ba0595b7c6dd0cd5d913c04900eb214b0fb28d599d071968b24e12d1b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T1EDB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tfjpmmgkrz.exe
- Size 514KB
- SHA256 5203f75feaa54748a91e8b1e9761dc688fc543d26bb74369ba9645aeaf5f1d0a
- MD5 289c08777976d86223fa55734a1563f6
- SHA1 7f074512eb83dce20fb5f6fc3ee566779aa14f6c
- SHA512 01966892bf7edd34d3592817519c893c1a5afb0dcc81c5fcbefb8a0209f4eec61cf71126c2399da1e97f4b0e162b4255090cd5a66abb5fe6d2479ccfd1693b5b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- TLSH T1E1B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 514KB
- SHA256 9582b2253ba9898ba5ef9b9bda94cf57ef892c2e09d17e13007a1fb914664cb2
- MD5 587712d1826b005f712dfeea29c7bd8c
- SHA1 ce3b7307aa03f1b5d716aab80c4d84ce7a95a375
- SHA512 66d8a5b0ee5c8cd2000c64e651152c49e1ca8fe843c5363877850682bcca251a43e58a9e8584ea61cf83f4e989ae75d0fd739ade0a42c032d227ca90924094a8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- TLSH T1EFB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 514KB
- SHA256 c13530b09af2478f2ce491d02cb3b82ea896803771afe15b67867ff414322079
- MD5 0fa4e5d67282e6706ce8a6b67544446f
- SHA1 16155f3739b2b6b0976be08fe95cf8fb15de6904
- SHA512 65bb32d3d22868d1d4a6bd74ed7876940058bd1344b6cf2c757b149c255bea5d65907865e927638571f562cbc6fed13773cf448d25490fc955afbff452fa2d88
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- TLSH T14DB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH