Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 02:45
Behavioral task
behavioral1
Sample
2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe
- Size 514KB
- Sample260418-c832csas5n
- SHA256 9f5558bced035ad9fca0c8fb532b7292ffeacd11f3bf1c9820f4ce01ff74653c
- MD5 71cf7f6c5b99d9ac0783999b0632d14b
- SHA1 b4dc2034ca0a8fb007b84ca45658c6891c17c39a
- SHA512 8eb2db8a706fb6408378deaf7b931855f9c3cd8740eed561256a29c62b6a7a0df9f5a36ecc6346077fb6bbc28f3ce467a425116c5c66f1b7f310dc6b9fa3854d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- TLSH T18CB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 11 IoCs
resource yara_rule behavioral2/files/0x001a00000002b438-5.dat family_sohanad behavioral2/files/0x0016000000027002-18.dat family_sohanad behavioral2/files/0x001a00000002b43b-27.dat family_sohanad behavioral2/files/0x001900000002b43c-32.dat family_sohanad behavioral2/files/0x001900000002b454-72.dat family_sohanad behavioral2/files/0x001900000002b455-79.dat family_sohanad behavioral2/files/0x001900000002b45b-91.dat family_sohanad behavioral2/files/0x001900000002b45c-97.dat family_sohanad behavioral2/files/0x001900000002b45d-103.dat family_sohanad behavioral2/files/0x002200000002b485-543.dat family_sohanad behavioral2/files/0x002200000002b485-546.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dzrhvyjyop.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dzrhvyjyop.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dzrhvyjyop.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dzrhvyjyop.exe - Executes dropped EXE 5 IoCs
pid Process 4924 dzrhvyjyop.exe 4920 xenmayijzgagsed.exe 4912 gkrlvtse.exe 1692 weldpqzzpbvyh.exe 1104 gkrlvtse.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dzrhvyjyop.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xsgeibsv = "dzrhvyjyop.exe" xenmayijzgagsed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oslrescd = "xenmayijzgagsed.exe" xenmayijzgagsed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "weldpqzzpbvyh.exe" xenmayijzgagsed.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: gkrlvtse.exe File opened (read-only) \??\n: gkrlvtse.exe File opened (read-only) \??\i: gkrlvtse.exe File opened (read-only) \??\w: dzrhvyjyop.exe File opened (read-only) \??\w: gkrlvtse.exe File opened (read-only) \??\v: dzrhvyjyop.exe File opened (read-only) \??\x: dzrhvyjyop.exe File opened (read-only) \??\b: gkrlvtse.exe File opened (read-only) \??\q: gkrlvtse.exe File opened (read-only) \??\h: gkrlvtse.exe File opened (read-only) \??\r: gkrlvtse.exe File opened (read-only) \??\m: dzrhvyjyop.exe File opened (read-only) \??\u: dzrhvyjyop.exe File opened (read-only) \??\k: gkrlvtse.exe File opened (read-only) \??\v: gkrlvtse.exe File opened (read-only) \??\b: dzrhvyjyop.exe File opened (read-only) \??\g: dzrhvyjyop.exe File opened (read-only) \??\j: dzrhvyjyop.exe File opened (read-only) \??\r: dzrhvyjyop.exe File opened (read-only) \??\s: dzrhvyjyop.exe File opened (read-only) \??\j: gkrlvtse.exe File opened (read-only) \??\w: gkrlvtse.exe File opened (read-only) \??\p: dzrhvyjyop.exe File opened (read-only) \??\u: gkrlvtse.exe File opened (read-only) \??\q: dzrhvyjyop.exe File opened (read-only) \??\t: gkrlvtse.exe File opened (read-only) \??\e: gkrlvtse.exe File opened (read-only) \??\z: dzrhvyjyop.exe File opened (read-only) \??\a: gkrlvtse.exe File opened (read-only) \??\h: gkrlvtse.exe File opened (read-only) \??\p: gkrlvtse.exe File opened (read-only) \??\b: gkrlvtse.exe File opened (read-only) \??\o: gkrlvtse.exe File opened (read-only) \??\z: gkrlvtse.exe File opened (read-only) \??\o: dzrhvyjyop.exe File opened (read-only) \??\t: dzrhvyjyop.exe File opened (read-only) \??\y: gkrlvtse.exe File opened (read-only) \??\m: gkrlvtse.exe File opened (read-only) \??\y: gkrlvtse.exe File opened (read-only) \??\h: dzrhvyjyop.exe File opened (read-only) \??\i: dzrhvyjyop.exe File opened (read-only) \??\n: dzrhvyjyop.exe File opened (read-only) \??\o: gkrlvtse.exe File opened (read-only) \??\s: gkrlvtse.exe File opened (read-only) \??\g: gkrlvtse.exe File opened (read-only) \??\e: gkrlvtse.exe File opened (read-only) \??\g: gkrlvtse.exe File opened (read-only) \??\j: gkrlvtse.exe File opened (read-only) \??\k: gkrlvtse.exe File opened (read-only) \??\l: gkrlvtse.exe File opened (read-only) \??\q: gkrlvtse.exe File opened (read-only) \??\a: dzrhvyjyop.exe File opened (read-only) \??\x: gkrlvtse.exe File opened (read-only) \??\n: gkrlvtse.exe File opened (read-only) \??\p: gkrlvtse.exe File opened (read-only) \??\x: gkrlvtse.exe File opened (read-only) \??\e: dzrhvyjyop.exe File opened (read-only) \??\i: gkrlvtse.exe File opened (read-only) \??\l: dzrhvyjyop.exe File opened (read-only) \??\l: gkrlvtse.exe File opened (read-only) \??\r: gkrlvtse.exe File opened (read-only) \??\u: gkrlvtse.exe File opened (read-only) \??\y: dzrhvyjyop.exe File opened (read-only) \??\z: gkrlvtse.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dzrhvyjyop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dzrhvyjyop.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5384-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001a00000002b438-5.dat autoit_exe behavioral2/files/0x0016000000027002-18.dat autoit_exe behavioral2/files/0x001a00000002b43b-27.dat autoit_exe behavioral2/files/0x001900000002b43c-32.dat autoit_exe behavioral2/files/0x001900000002b454-72.dat autoit_exe behavioral2/files/0x001900000002b455-79.dat autoit_exe behavioral2/files/0x001900000002b45b-91.dat autoit_exe behavioral2/files/0x001900000002b45c-97.dat autoit_exe behavioral2/files/0x001900000002b45d-103.dat autoit_exe behavioral2/files/0x002200000002b485-543.dat autoit_exe behavioral2/files/0x002200000002b485-546.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gkrlvtse.exe File created C:\Windows\SysWOW64\dzrhvyjyop.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\dzrhvyjyop.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\xenmayijzgagsed.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\xenmayijzgagsed.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\gkrlvtse.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\gkrlvtse.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File created C:\Windows\SysWOW64\weldpqzzpbvyh.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\weldpqzzpbvyh.exe 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dzrhvyjyop.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe gkrlvtse.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gkrlvtse.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gkrlvtse.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal gkrlvtse.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal gkrlvtse.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe gkrlvtse.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal gkrlvtse.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe gkrlvtse.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification C:\Windows\mydoc.rtf 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe gkrlvtse.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe gkrlvtse.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe gkrlvtse.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gkrlvtse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language weldpqzzpbvyh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gkrlvtse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dzrhvyjyop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xenmayijzgagsed.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" dzrhvyjyop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dzrhvyjyop.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB5B121449739EE52C8B9D633EFD7B8" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184FC70B1597DBC0B8C17FE7EDE434CD" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472D0D9D5283576D4377A070552DD77D8165D9" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFF82482C856E9047D65F7EE6BCE7E632594566416237D79C" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B6FE1A21DDD279D0D38B7A9017" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFAB1F963F194830E3A3186EB39E2B3FC02884369033EE2CD429E08D5" 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" dzrhvyjyop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf dzrhvyjyop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs dzrhvyjyop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" dzrhvyjyop.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4992 WINWORD.EXE 4992 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 4924 dzrhvyjyop.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 1692 weldpqzzpbvyh.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4912 gkrlvtse.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 4920 xenmayijzgagsed.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe 1104 gkrlvtse.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE 4992 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5384 wrote to memory of 4924 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 78 PID 5384 wrote to memory of 4920 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 79 PID 5384 wrote to memory of 4912 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 80 PID 5384 wrote to memory of 1692 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 81 PID 5384 wrote to memory of 4992 5384 2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe 82 PID 4924 wrote to memory of 1104 4924 dzrhvyjyop.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_71cf7f6c5b99d9ac0783999b0632d14b_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\dzrhvyjyop.exedzrhvyjyop.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\gkrlvtse.exeC:\Windows\system32\gkrlvtse.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104
-
-
-
C:\Windows\SysWOW64\xenmayijzgagsed.exexenmayijzgagsed.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4920
-
-
C:\Windows\SysWOW64\gkrlvtse.exegkrlvtse.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4912
-
-
C:\Windows\SysWOW64\weldpqzzpbvyh.exeweldpqzzpbvyh.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1692
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4992
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 514KB
- SHA256 8b3bc3f19b44ed90e87a48896eee66c4ca226293d4e6f650ef94e2eae57400ba
- MD5 a2363cb17e58d24b96b58e9df895cf10
- SHA1 040f5530abfdb8290946a5032c67bff7ffea03e6
- SHA512 cc1c183d86c12af3aca8e85cd80e9c7989eea7e32dacf317b0c160cedf0686fac1a9d6078b39bfeeef0e02fc5e35584af48f8e89107ea846a592211d463b331c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T1EDB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 514KB
- SHA256 7735e3dc2893db6c0eca03d925898991cd9aead8d49461fe0358382e3352fad7
- MD5 0e09b25bd91ffa619a2e9bdd9d1f13b2
- SHA1 fe77fec2dda1e59b8a74fd322b86d40707c26976
- SHA512 1bbd42fa5daa85de3d8294964ef0bc24328d8d2035a32841a212c5cb196da567e61a2e13f71120c5671c2ad3540fbf6fb77395d6cd2e8862115ebbfba61589a9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
- TLSH T13AB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD4DC6.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 198B
- SHA256 7d60881312baa47d90d4104a3bb9c78a01b651c6b0d14736425413084b641f49
- MD5 70716783013d165db060b3b111e36d6d
- SHA1 72554c6cc5334874319b1f44f252da402714c66a
- SHA512 c3cf81200f4ed35ce77de1c4d860a97a9c5dddd038ccbb8ac1819674a7a8bc99e8b70324948e0d84238b271e3f0631b985d53a147749d98e82e07828c38db932
- TLSH T1AAD0CA3B0328E7F0C37CA6B83031ACE867F2C89CE073003211D02EC60C80053389B400
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
- Size 18KB
- SHA256 2cd9d9b5980567d7c1753183125ff9624e8242d16ec71def375c7e62a91fa605
- MD5 f3e15268a74ef10ced07679b92085f10
- SHA1 96ac0e29a03d87ef5469b775cc02b2782c786897
- SHA512 f2eb66528649cd40cda8941b3e6a29ee8f500d81e13b5aa4c58707edc44d61d4a29c402c7bbfc2b2c78284fba75582483a316a06f90181979f10fa1b30797607
- SSDEEP 384:Jt+BNxt/ZtNNfr+GF9sQoIFAu/m0kTw1qE9r7x2quZdX8Ou:exllNzhFqI9m41qGF2q+8Ou
- TLSH T1A582AE38E5112974E7A38A7C509D11F1F0194543B706A09F38AEFBDD6D96FC74322A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 679B
- SHA256 6bd07f6f8cef86d86cfcab7a705cb4b33c797944c6f32cc0be6ed3acd6675a5c
- MD5 7886fdfacf713106b79530cd5d4e23ce
- SHA1 fe02cfa469835ec074e3802d23f8e09a3f206f62
- SHA512 d02591fd2489b034e47ffe980e28f78f7a5ce0270ee69a6c7ce385dc57d6d0d867c4096b6ae8726a5f8b3c903d64d10113d829a5097a3deedf20ce80361d940f
- TLSH T149012B121767CA56C05A4134109A2762AF70F903B719892FA10431759EB1A802E6C7BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 24B
- SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
- MD5 4fcb2a3ee025e4a10d21e1b154873fe2
- SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
- SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\OptimizeSync\ExportDisconnect.doc.exe
- Size 514KB
- SHA256 37d091c55bd6c7507389655d22bc1748f31df62b1dc9fab2d38700c812be42d2
- MD5 b2ac5b5406fb0cb124b063892a2c298f
- SHA1 441202f4014b66c4b2a28cacafd24c83b03d26b4
- SHA512 91168e09e451cda2d3a4b9c8de19f141dd4621640faec7a30f5a3c481662e02aaaf6e5dec3b128336822c4ffd6f58b082a68a247b96173558cd21e4e58422562
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6T:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G
- TLSH T108B4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\SuspendReceive\RequestOut.doc.exe
- Size 514KB
- SHA256 3f5feb71d275e049935bcc5c375a365ba4a84a8baad22ca1de1228bbd594ff17
- MD5 770cbb60b87cffefb253101e55fcf666
- SHA1 a05bccf5d931e6f43f2c5c88e63d2db5483a988b
- SHA512 9a8436fe31bb411edf6cc025ac72f5f6bd621402f5fb7b9945abcb30118932354598544f372909a5951e5dd0f77f7ea8c6f983bed1d28ca0945b124721256dd8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- TLSH T15DB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\dzrhvyjyop.exe
- Size 514KB
- SHA256 d8b57f42d866a93b373825106adc4de9024897ca7998ef55e4f50263f7b0d278
- MD5 b69b467b1072741f7ca4c2e1cbf24f30
- SHA1 f8ed46dcdf49dda4c1435d0e028fa70251d14796
- SHA512 540c0d94eb322ba6cafc71dc0ff9f7643bbb446c7aa0a00991ef8dd52997b7b5f1a921062d4387360d9636d894163b0742cc54d824c91dbfd921ca6e927cdc95
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- TLSH T131B4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\gkrlvtse.exe
- Size 514KB
- SHA256 efaf5cd905b718245b2cd6d33765b07897e7bdaed1dc7e376ba792d43c51b627
- MD5 8820c473780f285ef4798df41b4dac02
- SHA1 79f26dd1d01388d44d0930808b4fd2c3acc5153b
- SHA512 5d45a7439de9ec87fe70fc5774c50a0fee3bc86cbaca0a2ba8c94a65ab51080a8299aaf4efb56716b8485ffccb3bf7746255804375c90787be467735f811579e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- TLSH T14BB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\weldpqzzpbvyh.exe
- Size 514KB
- SHA256 bd4d8a5ade0a9e7c59d7f1a3d6d3cb505d7fabb05fb9aaaaff456f85d44957af
- MD5 201017946d849770a177149e415e19a3
- SHA1 c3afe532105106400cb9014cfe34221b26d92bd0
- SHA512 5bf2f57e1dcdd8057d9ef2f3db5821af36c9455e712f33abc6deb7a4208d36fbee41c481240b18e98667b82de859772b548f262dfddee09031806ee3705df897
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T18FB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xenmayijzgagsed.exe
- Size 514KB
- SHA256 d0c8eb45cab0b8073ebc8cf0d1c8a06dc5ff3778719cc40af1ce3900c286fe2b
- MD5 f783ed747862b641343201d25b1b69b1
- SHA1 6dee6e7f2a15b9b1afdf8aad535755e7fb010c5a
- SHA512 9f9d8b590604e6f104d1c0d3857060c2abafbdd905a12c95de592154fdca0cc812f1040c36de3b50c601ebfcb6075de23cc65ed112f0d72b6dc4f413625981d1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O
- TLSH T172B4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Roaming\UninstallConvertTo\ConvertPop.doc.exe
- Size 514KB
- SHA256 f47a8eecdb70fbbedad213ef0041e054eeefdf73b85e9ba6b65b0b93a8699d03
- MD5 ac73df7134fb88a149a89df03bea4ea2
- SHA1 d968a34dd4a125de021c1f0a7c7dc2cf605b15aa
- SHA512 7aec0cce3e41b66f52212c1e73a65bdb284ab4a431824f9c6234a965651856e5b381c34f0c33a40e011fa327be9c5203d2283a4361c6840ab6ee71445d145c5f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I
- TLSH T116B4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 514KB
- SHA256 3ec3cdc3402b56aad1b720963dd8b414a45db0941712852294d23c807973c0d3
- MD5 3fc13e8d63b5d61efe6016ee95424c6f
- SHA1 bd5d1a9377e75d2e093fbc3ac614a3da7f052552
- SHA512 2d4e25c829764ff377e7db335808895702a1e1d324831c33cca15be9d308db916af1699f1a522a8b818b66993d7a76a499e9b2616bed150d53ef9109a9dba54e
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T17EB4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 515KB
- SHA256 a47e6dc6c273ac76636144f72c437f72a47b9ede76db0f9b556bf2ed9868ee12
- MD5 494511b5365af5ec611b41c94ea43726
- SHA1 7cdf3477fd342a8bb6e9066dec5b2c8f24a79b1b
- SHA512 8b634f5d62fea7a41f8682fd8d74c7cc6c88aeef192fb1a6c908568e326e29adc7b3600a35010fe308ec40648decebaf325eeda7a71204d6da670945332720e3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T1C8B4BF2276E1B0B2E96325F00F76D739A777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH