Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 03:11
Behavioral task
behavioral1
Sample
2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe
- Size 512KB
- Sample260509-dpvrbadv9m
- SHA256 5b308fd622d070cf512d5140811a2e914ea9979b36b9d1eb3847a411e89f4a22
- MD5 74a3d5668f9c4d7517fbf63079d56368
- SHA1 fa08a7af8ad9d43f456050b5edee54ee57930782
- SHA512 4e5c9c2e7334c5b33b95fcacca097d5de5d72fa16740259ddc4c2cd191610b7ca4d9a6fda96e3eeb62a6072da0047494a7a8bd24f94aeeef0310a72f5f718abf
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T1D9B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 10 IoCs
resource yara_rule behavioral1/files/0x000600000001e6d1-5.dat family_sohanad behavioral1/files/0x000300000001dbfc-18.dat family_sohanad behavioral1/files/0x0006000000021e14-29.dat family_sohanad behavioral1/files/0x000500000002274c-32.dat family_sohanad behavioral1/files/0x0008000000024165-57.dat family_sohanad behavioral1/files/0x0008000000024166-63.dat family_sohanad behavioral1/files/0x000c000000024236-75.dat family_sohanad behavioral1/files/0x0008000000024286-78.dat family_sohanad behavioral1/files/0x000700000002428c-97.dat family_sohanad behavioral1/files/0x000700000002428c-101.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vaduhertny.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vaduhertny.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" vaduhertny.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vaduhertny.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe - Executes dropped EXE 5 IoCs
pid Process 3780 vaduhertny.exe 1632 xlymhmqvytxoqrq.exe 3948 aufomnlc.exe 1412 amtngffuwjylq.exe 3820 aufomnlc.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" vaduhertny.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dbaknhfu = "xlymhmqvytxoqrq.exe" xlymhmqvytxoqrq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "amtngffuwjylq.exe" xlymhmqvytxoqrq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gbrigolm = "vaduhertny.exe" xlymhmqvytxoqrq.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: aufomnlc.exe File opened (read-only) \??\o: aufomnlc.exe File opened (read-only) \??\t: vaduhertny.exe File opened (read-only) \??\x: vaduhertny.exe File opened (read-only) \??\k: aufomnlc.exe File opened (read-only) \??\x: aufomnlc.exe File opened (read-only) \??\g: aufomnlc.exe File opened (read-only) \??\q: aufomnlc.exe File opened (read-only) \??\e: vaduhertny.exe File opened (read-only) \??\k: vaduhertny.exe File opened (read-only) \??\m: vaduhertny.exe File opened (read-only) \??\n: aufomnlc.exe File opened (read-only) \??\v: vaduhertny.exe File opened (read-only) \??\n: aufomnlc.exe File opened (read-only) \??\x: aufomnlc.exe File opened (read-only) \??\a: vaduhertny.exe File opened (read-only) \??\n: vaduhertny.exe File opened (read-only) \??\z: vaduhertny.exe File opened (read-only) \??\r: aufomnlc.exe File opened (read-only) \??\j: aufomnlc.exe File opened (read-only) \??\p: aufomnlc.exe File opened (read-only) \??\e: aufomnlc.exe File opened (read-only) \??\v: aufomnlc.exe File opened (read-only) \??\o: vaduhertny.exe File opened (read-only) \??\p: aufomnlc.exe File opened (read-only) \??\l: aufomnlc.exe File opened (read-only) \??\s: aufomnlc.exe File opened (read-only) \??\i: aufomnlc.exe File opened (read-only) \??\y: aufomnlc.exe File opened (read-only) \??\k: aufomnlc.exe File opened (read-only) \??\g: vaduhertny.exe File opened (read-only) \??\i: vaduhertny.exe File opened (read-only) \??\r: vaduhertny.exe File opened (read-only) \??\s: vaduhertny.exe File opened (read-only) \??\y: vaduhertny.exe File opened (read-only) \??\t: aufomnlc.exe File opened (read-only) \??\z: aufomnlc.exe File opened (read-only) \??\h: aufomnlc.exe File opened (read-only) \??\y: aufomnlc.exe File opened (read-only) \??\q: aufomnlc.exe File opened (read-only) \??\r: aufomnlc.exe File opened (read-only) \??\t: aufomnlc.exe File opened (read-only) \??\l: vaduhertny.exe File opened (read-only) \??\u: vaduhertny.exe File opened (read-only) \??\w: vaduhertny.exe File opened (read-only) \??\a: aufomnlc.exe File opened (read-only) \??\h: aufomnlc.exe File opened (read-only) \??\e: aufomnlc.exe File opened (read-only) \??\u: aufomnlc.exe File opened (read-only) \??\w: aufomnlc.exe File opened (read-only) \??\p: vaduhertny.exe File opened (read-only) \??\g: aufomnlc.exe File opened (read-only) \??\l: aufomnlc.exe File opened (read-only) \??\u: aufomnlc.exe File opened (read-only) \??\a: aufomnlc.exe File opened (read-only) \??\h: vaduhertny.exe File opened (read-only) \??\b: aufomnlc.exe File opened (read-only) \??\j: aufomnlc.exe File opened (read-only) \??\w: aufomnlc.exe File opened (read-only) \??\b: aufomnlc.exe File opened (read-only) \??\z: aufomnlc.exe File opened (read-only) \??\m: aufomnlc.exe File opened (read-only) \??\b: vaduhertny.exe File opened (read-only) \??\j: vaduhertny.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" vaduhertny.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" vaduhertny.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/552-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000600000001e6d1-5.dat autoit_exe behavioral1/files/0x000300000001dbfc-18.dat autoit_exe behavioral1/files/0x0006000000021e14-29.dat autoit_exe behavioral1/files/0x000500000002274c-32.dat autoit_exe behavioral1/files/0x0008000000024165-57.dat autoit_exe behavioral1/files/0x0008000000024166-63.dat autoit_exe behavioral1/files/0x000c000000024236-75.dat autoit_exe behavioral1/files/0x0008000000024286-78.dat autoit_exe behavioral1/files/0x000700000002428c-97.dat autoit_exe behavioral1/files/0x000700000002428c-101.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vaduhertny.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File created C:\Windows\SysWOW64\xlymhmqvytxoqrq.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File created C:\Windows\SysWOW64\aufomnlc.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\aufomnlc.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File created C:\Windows\SysWOW64\amtngffuwjylq.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\amtngffuwjylq.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification C:\Windows\SysWOW64\xlymhmqvytxoqrq.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll vaduhertny.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe aufomnlc.exe File created C:\Windows\SysWOW64\vaduhertny.exe 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aufomnlc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal aufomnlc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aufomnlc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal aufomnlc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aufomnlc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aufomnlc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe aufomnlc.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aufomnlc.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification C:\Windows\mydoc.rtf 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aufomnlc.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe aufomnlc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vaduhertny.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlymhmqvytxoqrq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aufomnlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amtngffuwjylq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aufomnlc.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB02F479339ED53BABADC3299D7C5" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" vaduhertny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32452C799C2D82236A3476D577242DDA7D8065AB" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB7FF6621D1D20ED0A18A759167" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh vaduhertny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf vaduhertny.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FF8A4F5F851F9146D7217D93BC93E6355936664E6332D6EC" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C60815E3DAB0B8CA7C95EDE337CC" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFAB8FE64F19483783B35819A3E97B3FD03F042600349E2CF459B09D2" 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat vaduhertny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" vaduhertny.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3056 WINWORD.EXE 3056 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 1632 xlymhmqvytxoqrq.exe 3820 aufomnlc.exe 3820 aufomnlc.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 1632 xlymhmqvytxoqrq.exe 3948 aufomnlc.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 1412 amtngffuwjylq.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3820 aufomnlc.exe 3820 aufomnlc.exe 3820 aufomnlc.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 1632 xlymhmqvytxoqrq.exe 3948 aufomnlc.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 3948 aufomnlc.exe 3948 aufomnlc.exe 1412 amtngffuwjylq.exe 1632 xlymhmqvytxoqrq.exe 1412 amtngffuwjylq.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3780 vaduhertny.exe 3820 aufomnlc.exe 3820 aufomnlc.exe 3820 aufomnlc.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3056 WINWORD.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 552 wrote to memory of 3780 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 84 PID 552 wrote to memory of 1632 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 85 PID 552 wrote to memory of 3948 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 86 PID 552 wrote to memory of 1412 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 87 PID 552 wrote to memory of 3056 552 2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe 88 PID 3780 wrote to memory of 3820 3780 vaduhertny.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_74a3d5668f9c4d7517fbf63079d56368_elex_stop_yuner.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\vaduhertny.exevaduhertny.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\aufomnlc.exeC:\Windows\system32\aufomnlc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3820
-
-
-
C:\Windows\SysWOW64\xlymhmqvytxoqrq.exexlymhmqvytxoqrq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632
-
-
C:\Windows\SysWOW64\aufomnlc.exeaufomnlc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3948
-
-
C:\Windows\SysWOW64\amtngffuwjylq.exeamtngffuwjylq.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 5c61a60d8fe5fb0056173eaa816bb6459e583ca56613f0f5d839a3e8ed9fc0cb
- MD5 c94a2a55cc30ef699eb01c6e72d3ab62
- SHA1 3ebef988d6b98d02d5344e5e7a3df35d18575820
- SHA512 4acbd1b6bb1fa7bcdbb709910d5e7bb12c585bcc7008049e3c5911abbbc004bd5d67e82584c988fe6c3ae8224fcb8c0c66b2ed3d1a96a9628111281d26bb9e3f
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- TLSH T114B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 b3aceaa8319daf82063f1fc0436c61173e6c46c10db78f0b49335f0f45198682
- MD5 bb860689f17b24c7bf4e01fe3a42da3a
- SHA1 f9e5f8f22e9f2da9f303b1818a95db557783ecef
- SHA512 430fcaa03a4b68dc810b0a8c8480107f881efc14a0feb6c3b0c95c4df9a21efc0fe3be203831148fe96cfade90010d960f7d8691633dd6be8fc8d85c9b71e31d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5K
- TLSH T129B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDDAA0.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 331B
- SHA256 e41aa4c7c03b3b24975c0a90fa4098421dc34f55461a745878383f08a07ba78c
- MD5 d6503cdc80cac96b7b5ea79798dd4180
- SHA1 574e7cdd678855d13230a302520141c4e6473d34
- SHA512 6ecfdfb3c7f7aff5629a6a34b029bc5ff29fd60d354c3483ff40d11c73b1a3136254a0e51b93d0c341e49ae6a44ab59c55a1237be24e0e4dc2b6fab57981dc3e
- TLSH T1E6E0C2672325D7F043BC41F578BC6CE1ABF64C14C399043455CC1DD60C243A3218B20A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 e519cb41d9676d4468a937895ec38a940a89d5235581aef75dbf40809f5dc4b5
- MD5 015716092d7442854ea35118214d2691
- SHA1 44f633f2bf7c6c62411111b7aeb1aa14771ba4c4
- SHA512 b73228315f53a4d19c3c5947293b29f6436f3767bfd8d98715f3e315ea7653a09755c4a1bcf237e8d1fb0f126b09308137bd78b3fef4ff5431111d662ebfd608
- TLSH T11C412041069F9FDFD09503338A399719CF707C41EB66550EA2C8D236AEB0600EF4DAAA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 0598bceeaee79a509ca51f64d9f1aae9d308f7494c322970bbfb903b3b48fef1
- MD5 7a837d3b54e6d4911984f09ffc93d241
- SHA1 f73877ca1c11195150b4fa8c3d25df5873336069
- SHA512 5ce81066daf77216bd91968bd9428f5ebddf83d1bd8e95c84c3e074c18ed97940fdb127d61ca236ee1cd1993b67fb8f437de04ad68c79fd604c2c0a66dc34aea
- TLSH T1A021D3114B8F5F9FD055037386398719CFB07C41E765510EA7C8D2366EB5A00EF4DA99
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\OutProtect\TraceMove.doc.exe
- Size 512KB
- SHA256 3f0157cc5b1ee267ae72f733a433b8d045f45cb2114518180f182bdb89489c57
- MD5 4c358a6aace61a19db2691bb1f0cde1a
- SHA1 a25efe7bc653a7959c7883fd734931828e8d2872
- SHA512 2338317ae9a79e120d05c6be3ee91429e686da1787800504bc237db1c562d7a8c971f88627665af7ab51787daf539d0e42449971387bf9cf19aab9675f169911
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
- TLSH T114B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ConfirmMove.doc.exe
- Size 512KB
- SHA256 c45e6da3e668010aa69aecb96a93a3da3a985d3dd96f615f4f7c31189da99b09
- MD5 6747b310f5e5d57fcab05ab16eb59fe4
- SHA1 c4dc5cb2f4123393accfd8e2362599b055bdcee0
- SHA512 9743820d73a9e47858fb38a96b569ea34fdb6d6928ec2734f0f7b27f1c3c321466f4c4c337fce24e10414e519ea96fa4832fbb5e9d4c49e086c7644ce8cbb7ca
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u
- TLSH T1CAB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\amtngffuwjylq.exe
- Size 512KB
- SHA256 f428f398a232e4adc08bdb10166c1c23a39929e4303e2a92c63f23d6ef458c6d
- MD5 c5d6544d35944df2f0faac2f345d4b79
- SHA1 5f69436344da6e54092cce470f781b5f9406864a
- SHA512 f92f85c37491d1c7faa8ca3c7506b76677bd4120a1d83223c57d7ae2e65a00fc8dbfa62e5022ec6888c3077909c83d0c50aeedf4e599b07ab8877e09d1aee576
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- TLSH T13FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\aufomnlc.exe
- Size 512KB
- SHA256 099bbd58478b89767a3f7af1d71f9fb5e84cfbdf3bfb46e3fe6abfd89e749b01
- MD5 fc9463479172bf183e65dd425120b870
- SHA1 3f8fcbfd7d9c21a461e23688c12bac9fb804bead
- SHA512 da9044aa2a7bd8aebcf31ffb5fefa6e383d8da85b98d2a6371ce501a8412baa67933b88f6f87360e8bb1b7a71c37d80ecca9b26546b4843b4c6c1672ddef3a54
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T18AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\vaduhertny.exe
- Size 512KB
- SHA256 01f90695d5c5a9156eed2739ec07cf96788d51266051422e310c673b7707793d
- MD5 c2b648cbd986e312b4edae4a9609b67b
- SHA1 e4f7fff58b768e942f177b5b68cf271c28c90d1e
- SHA512 0ca4ad56cf2654718eeeb9df86f950c13dc2e6a0de03d27a7e0ed90900df7a3cf19c898d380d8056018ba68e8fc3f0d5960af45146d007043e340c101bd2cc9a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- TLSH T1FEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xlymhmqvytxoqrq.exe
- Size 512KB
- SHA256 c1d06d2f8da92b99e357482e7807a02f1045e8fed30687d33ddf8c99cc70747f
- MD5 6732922a8e703705add9a6f4e171ec98
- SHA1 971466f09f4e0fecde277e68018c724303c53f38
- SHA512 20fddb9df551c81fe26546f01e1f310b0f567063be0a892545dfa245edbc3c879e58097d150c1c96857ee5a8b2b6dc2375d40a79e9eb8f3572e4ef6f22ea804a
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- TLSH T12DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 718f5bbd724b1c95e19a65ad0d8143787762c2f5d64daf978ff7900ae5312fbe
- MD5 4825d062c37305f1ae78a0715db0f43b
- SHA1 e032aaf799b1f944d75628f7fb2003af54f61f4e
- SHA512 040c8519939f8ec38a6dd4de0dd02088a1c2350c50bc899a3cba64ce293589e9c4d5d1ebb01297b550a1da4508b29fb68787a7a46f240cb95202d51ce72cbfce
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T1FEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 81916f79de6bc5b7ce09cda651f2a85e5fee11c3905c7ea20fb3b117e07690d8
- MD5 e2a0949e3cf689083a4e6d26a1f36c10
- SHA1 b52931ee5d5447010588d38261ea6b0fa9ef857c
- SHA512 e9086632f2af0f50fb3103deafb9b28f6714ae93d20853ba539f971ac2553f3333caeda4d37f823becac8687cdd738620eb11d1196c6fc46ed5ca1f68acebc74
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T10FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH