Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 03:05
Behavioral task
behavioral1
Sample
2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe
- Size 512KB
- Sample260425-dlln8sdy21
- SHA256 b8e10ca4de61e5e8939cf3fa67a9f612829fe854987377b5fa1197b259ff8998
- MD5 b6df13aeaf8595a97872555a95a13768
- SHA1 5aaf8be0539eb0ea8a3c455d46c02ae59b06aff6
- SHA512 22f126bbbc043f48779a9b78444f9a7021527c516d59c3d7aea74c224a27bb51bd2c0a1d005be9c3ab8fe583da5d9d82c4ddede391d00ddd2ee9f0805a5597f4
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- TLSH T131B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral1/files/0x0007000000024479-5.dat family_sohanad behavioral1/files/0x0008000000024475-18.dat family_sohanad behavioral1/files/0x000700000002447b-31.dat family_sohanad behavioral1/files/0x000700000002447a-30.dat family_sohanad behavioral1/files/0x000700000002448a-68.dat family_sohanad behavioral1/files/0x0007000000024489-66.dat family_sohanad behavioral1/files/0x000900000002448c-92.dat family_sohanad behavioral1/files/0x0009000000024493-215.dat family_sohanad behavioral1/files/0x0009000000024493-220.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" brolsbmzfo.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" brolsbmzfo.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" brolsbmzfo.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" brolsbmzfo.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe - Executes dropped EXE 5 IoCs
pid Process 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 744 ywmcxrfp.exe 4328 vuazvddfmuevc.exe 1420 ywmcxrfp.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" brolsbmzfo.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fsfifptc = "brolsbmzfo.exe" yseudjrijpkymoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jhigtnlm = "yseudjrijpkymoc.exe" yseudjrijpkymoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "vuazvddfmuevc.exe" yseudjrijpkymoc.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: ywmcxrfp.exe File opened (read-only) \??\k: brolsbmzfo.exe File opened (read-only) \??\p: brolsbmzfo.exe File opened (read-only) \??\r: brolsbmzfo.exe File opened (read-only) \??\e: ywmcxrfp.exe File opened (read-only) \??\e: ywmcxrfp.exe File opened (read-only) \??\u: ywmcxrfp.exe File opened (read-only) \??\n: brolsbmzfo.exe File opened (read-only) \??\q: brolsbmzfo.exe File opened (read-only) \??\g: ywmcxrfp.exe File opened (read-only) \??\n: ywmcxrfp.exe File opened (read-only) \??\q: ywmcxrfp.exe File opened (read-only) \??\g: brolsbmzfo.exe File opened (read-only) \??\k: ywmcxrfp.exe File opened (read-only) \??\u: ywmcxrfp.exe File opened (read-only) \??\j: ywmcxrfp.exe File opened (read-only) \??\r: ywmcxrfp.exe File opened (read-only) \??\e: brolsbmzfo.exe File opened (read-only) \??\t: brolsbmzfo.exe File opened (read-only) \??\x: ywmcxrfp.exe File opened (read-only) \??\y: ywmcxrfp.exe File opened (read-only) \??\h: ywmcxrfp.exe File opened (read-only) \??\q: ywmcxrfp.exe File opened (read-only) \??\t: ywmcxrfp.exe File opened (read-only) \??\y: ywmcxrfp.exe File opened (read-only) \??\z: ywmcxrfp.exe File opened (read-only) \??\l: brolsbmzfo.exe File opened (read-only) \??\h: ywmcxrfp.exe File opened (read-only) \??\w: ywmcxrfp.exe File opened (read-only) \??\y: brolsbmzfo.exe File opened (read-only) \??\a: ywmcxrfp.exe File opened (read-only) \??\g: ywmcxrfp.exe File opened (read-only) \??\m: ywmcxrfp.exe File opened (read-only) \??\m: brolsbmzfo.exe File opened (read-only) \??\w: brolsbmzfo.exe File opened (read-only) \??\j: ywmcxrfp.exe File opened (read-only) \??\b: ywmcxrfp.exe File opened (read-only) \??\s: ywmcxrfp.exe File opened (read-only) \??\l: ywmcxrfp.exe File opened (read-only) \??\w: ywmcxrfp.exe File opened (read-only) \??\u: brolsbmzfo.exe File opened (read-only) \??\v: brolsbmzfo.exe File opened (read-only) \??\i: ywmcxrfp.exe File opened (read-only) \??\s: brolsbmzfo.exe File opened (read-only) \??\x: brolsbmzfo.exe File opened (read-only) \??\l: ywmcxrfp.exe File opened (read-only) \??\b: ywmcxrfp.exe File opened (read-only) \??\m: ywmcxrfp.exe File opened (read-only) \??\a: ywmcxrfp.exe File opened (read-only) \??\k: ywmcxrfp.exe File opened (read-only) \??\a: brolsbmzfo.exe File opened (read-only) \??\i: brolsbmzfo.exe File opened (read-only) \??\o: brolsbmzfo.exe File opened (read-only) \??\z: brolsbmzfo.exe File opened (read-only) \??\n: ywmcxrfp.exe File opened (read-only) \??\o: ywmcxrfp.exe File opened (read-only) \??\x: ywmcxrfp.exe File opened (read-only) \??\h: brolsbmzfo.exe File opened (read-only) \??\j: brolsbmzfo.exe File opened (read-only) \??\o: ywmcxrfp.exe File opened (read-only) \??\p: ywmcxrfp.exe File opened (read-only) \??\r: ywmcxrfp.exe File opened (read-only) \??\i: ywmcxrfp.exe File opened (read-only) \??\v: ywmcxrfp.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" brolsbmzfo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" brolsbmzfo.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3496-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0007000000024479-5.dat autoit_exe behavioral1/files/0x0008000000024475-18.dat autoit_exe behavioral1/files/0x000700000002447b-31.dat autoit_exe behavioral1/files/0x000700000002447a-30.dat autoit_exe behavioral1/files/0x000700000002448a-68.dat autoit_exe behavioral1/files/0x0007000000024489-66.dat autoit_exe behavioral1/files/0x000900000002448c-92.dat autoit_exe behavioral1/files/0x0009000000024493-215.dat autoit_exe behavioral1/files/0x0009000000024493-220.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\yseudjrijpkymoc.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\yseudjrijpkymoc.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ywmcxrfp.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\ywmcxrfp.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ywmcxrfp.exe File created C:\Windows\SysWOW64\brolsbmzfo.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\brolsbmzfo.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created C:\Windows\SysWOW64\vuazvddfmuevc.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\vuazvddfmuevc.exe 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll brolsbmzfo.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ywmcxrfp.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File opened for modification C:\Program Files\AssertDismount.doc.exe ywmcxrfp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ywmcxrfp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ywmcxrfp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ywmcxrfp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ywmcxrfp.exe File created \??\c:\Program Files\AssertDismount.doc.exe ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ywmcxrfp.exe File opened for modification \??\c:\Program Files\AssertDismount.doc.exe ywmcxrfp.exe File opened for modification C:\Program Files\AssertDismount.nal ywmcxrfp.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ywmcxrfp.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ywmcxrfp.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ywmcxrfp.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ywmcxrfp.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification C:\Windows\mydoc.rtf 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ywmcxrfp.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ywmcxrfp.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yseudjrijpkymoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ywmcxrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vuazvddfmuevc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ywmcxrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brolsbmzfo.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC2B02D47E3399A52BDB9D03293D4BF" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412D7A9C2683536D3F76D270542DAD7DF164D6" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCF9CEF913F2E583743B4B81993998B0FC038D4363024BE1BA42EF08A9" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat brolsbmzfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc brolsbmzfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" brolsbmzfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs brolsbmzfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg brolsbmzfo.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F768B6FE1D21D1D209D1D58B7D9110" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC6791590DAC7B9C07C93ED9234BD" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8CFC824858821B9045D7587D91BD92E144584267426241D7EE" 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" brolsbmzfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" brolsbmzfo.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4000 WINWORD.EXE 4000 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4704 brolsbmzfo.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 1300 yseudjrijpkymoc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 4328 vuazvddfmuevc.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 744 ywmcxrfp.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 4328 vuazvddfmuevc.exe 4704 brolsbmzfo.exe 1300 yseudjrijpkymoc.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe 1420 ywmcxrfp.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4000 WINWORD.EXE 4000 WINWORD.EXE 4000 WINWORD.EXE 4000 WINWORD.EXE 4000 WINWORD.EXE 4000 WINWORD.EXE 4000 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4704 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 85 PID 3496 wrote to memory of 1300 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 86 PID 3496 wrote to memory of 744 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 87 PID 3496 wrote to memory of 4328 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 88 PID 3496 wrote to memory of 4000 3496 2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe 89 PID 4704 wrote to memory of 1420 4704 brolsbmzfo.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_b6df13aeaf8595a97872555a95a13768_elex_stop_yuner.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\brolsbmzfo.exebrolsbmzfo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\ywmcxrfp.exeC:\Windows\system32\ywmcxrfp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1420
-
-
-
C:\Windows\SysWOW64\yseudjrijpkymoc.exeyseudjrijpkymoc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1300
-
-
C:\Windows\SysWOW64\ywmcxrfp.exeywmcxrfp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:744
-
-
C:\Windows\SysWOW64\vuazvddfmuevc.exevuazvddfmuevc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4328
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4000
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 23699c6e953ed763e6ea22dd059a272e9402f4791de58aedb476922dad94fe06
- MD5 5b3baab0f6d212306ad84b238b1c817e
- SHA1 a19df548e7254f1845c6fd751eb230f44968aa89
- SHA512 d886cd75917e32fe00ab968fb2ad5a3e5e595c75f2fb1cb1a813233e7c5e0a867a7e5edf0a2565cc6ab4896e5fba53870ec34bc37b0f148ed6203d6e1ab64712
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- TLSH T13CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 93b34d34e1622fa9dd05cc89ce5a57b36129c670c320e78a924a7c7097c0b264
- MD5 e23c8cb1473302add5a477f7ec4486aa
- SHA1 de31ac3d0750f63116d4317b619c4cb0083da3a3
- SHA512 40ccd9c303912e16cd24f9f8a89a351c57f4cc4c909099b2e9ceaa9271c3fb93ee0c81e4c482e46df5e43a5a375b1a1bd20c7591ccee9359e94b8f905f738227
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
- TLSH T18EB4AF2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD94F6.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\InitializeConnect\CompareRequest.doc.exe
- Size 512KB
- SHA256 f6fd5dc710df2da4c595f41e10b5cabcb1821d5df3acb927b2b77769b431fb50
- MD5 2dc2dd88a5aed5e4b791b4c5099b6d2b
- SHA1 23b9c4a661fd1d012ff82c49294f815423d870ad
- SHA512 ea33ac57dad065a19335a44caf7c2ecd911137d04f974c83c461f4fa52e2568f461afeece09cb7c0f7f72cbf0ed19b952ab400d558ed28cc0d17a79d05191c19
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj67:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- TLSH T1E1B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 361B
- SHA256 fe97be00ce2828d44e06d4edde45ffffc996807c13befea65e8327818f26078e
- MD5 b45a8ccac98630742fb4cddd524f65bd
- SHA1 0c9dca603f11e9e97ef0556c10ae224c66c73eb2
- SHA512 ff94fd14f1a543b48114a9a2943f24f643b6d41cd6a16e2e817bf9b5e0538ea3af072fab1aa7614c0a1de2312d031b20732802890e264e434b865f668b4c39a3
- TLSH T156E04F277771E3E9837C5559BC3DACE01BF18C5CCBA8143111CC0CA60D792436087A09
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 1689e9fce665b799eca154522efb24b3684c99b9af35b8afae9e6d7fe16f3f5a
- MD5 47fbbee513cdeb3d12482d62f31fd5f1
- SHA1 e358efabe4f98bff490ccccaa843fa40d2b435b0
- SHA512 0e746154cd6b728fe363355b2667fc056da4541e2a818116a621d7cc9d85948b62ef5b69c02dd8023ebb2ea34e08c82b5cbb6a6afbd13c16cf033351e2942e47
- TLSH T1C161E113569BAFAEE050C37A822A831ADF30BD43EB0D564D1A54517A6C74B005B4E72E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 5c6dd25f01522d1f4164bd2f9fe0660358d6ee86bb39abece0da7387345e809d
- MD5 096cfa91d93fd0d542e66d46a91526e6
- SHA1 44000c0d232612460b4485b5d26dc05cb21c968e
- SHA512 60d3ae3d9e38c20ea8f9c21246320eb6763d0a884f30b7efe3a75190496ff3435d336436fb402f060713ffd9bd451eeb3d88e5cd87b8d8c64198bd1a1ddab86f
- TLSH T1CB81D212529FAFAEE050C37A812F831ADF30BD43EB0D5A4D1A5461796CB4B005A4E72E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\brolsbmzfo.exe
- Size 512KB
- SHA256 d8504a63b7b7c4a766bc8410147a74c02f97b70d0f9a4127452026ce745f087a
- MD5 e6a9f26bccf3200e2b1010ff1274d34b
- SHA1 7e10e58331b3177e2eb295352b442db770dc6bf0
- SHA512 202ccad118283830a597feadc56fc83f34475853c67046789c3b890b255d5184f6cb4835c46cc42c1df5e1426782eab69ee6f9ff21cca7b793dd0158629d5e28
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- TLSH T1C7B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\vuazvddfmuevc.exe
- Size 512KB
- SHA256 1bc93e6d0f80d89a867cb34b836384f4e0589a227847944eebe7a626322b2bc3
- MD5 672254a2214c40b3f0a75830250417cc
- SHA1 36ba2e2213664e6b56a6178a9eebaed6e68d7f8f
- SHA512 6b3f259a5675442977184c043b69938ac30ee5541f6714c265832e305813a1f10a48d640efbccd5ad0ef8c9ee3daef4593bb5915b9eae3cd43df4a57bb0376eb
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T17CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\yseudjrijpkymoc.exe
- Size 512KB
- SHA256 ee3162fa322afd7f595377b3a783d993f9e7aa8988ebe5ecd732ae9a39075c33
- MD5 8b1127ad948aad1c3f77fd6e6a8f66e2
- SHA1 8230283bad5b06a27d5160352a03205eaf796733
- SHA512 0016112afcd1042ec510add11ea7c039c03f9cb76d05fc661601ff96f4a32e1e59051df412e6b75f4f2730fc9d2c6d8bfe757ed267e13087978feff3579bce24
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
- TLSH T12CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ywmcxrfp.exe
- Size 512KB
- SHA256 971e42d0da79c193b48f3c9d253465f79095e1f8c19b52e8696e6a78ba371c8a
- MD5 f94405957d86561eb06304a88653ace0
- SHA1 889ae584a3f23b6a0b38ef48bee05a7c4f19c312
- SHA512 61e3c92ce45202b2696b18658ebd5ea6b603b5c189b625d5c47f6c7616dd21074a1b5662ddef889c9783593cac26147eea2f39dcc6258181062feb646c473275
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- TLSH T147B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 8ed1d50c6315624cd19f9e5b9bf042e9db9dfb12c02f9f4ced9d6510fb6893b4
- MD5 e02364add5013ad4cbfa6e903e46dc07
- SHA1 5aa0bbc3e0ac058208e4a47eeac28b016422680b
- SHA512 5a35064576f7622ed64d483b3697a441fefefd3590620727c07a556b0502b4a74c3fe8ac3338592a955b70bdebd7c9a900b3f1fca4cd051da3178e1d52501c29
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T197B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 9976b6e5f0eaa9b75d0d8437d9f0fb376ef4c98a26228daa1c15a1e16d8f05ef
- MD5 71c48a2c692ca221edbfa4c89f1c1369
- SHA1 dc19692abf173a578897c4b54fae9a19e8a2596f
- SHA512 94c7dce62c1fece0382ce33603ee76e2955e1683948574499b7e501057d4dd6afda9982fbb934a1410290ec406bf82dee38a02ecf73fbc228b84813258713d86
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- TLSH T1FFB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH