Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 04:42
Behavioral task
behavioral1
Sample
2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe
- Size 512KB
- Sample260705-fb7vtshw21
- SHA256 490618a3466db3ff1ec0ffaf49a57e0094eb32865559274d8c6063a324f5bfc3
- MD5 ea5a41a0e1680d133f62d9ad4c6d4db6
- SHA1 69825719c7255a4f43fcff97afe1e2177c1fbd64
- SHA512 292589e938b63c892901c0aab42c6b2750d4cd97b1dc895a2a0a1a78228349dcf66c3dcac805a2d0e223b97ea277accfa44d33e3bfb6e038683ac50b231d0108
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T110B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 11 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5fa-5.dat family_sohanad behavioral2/files/0x002a0000000116ed-11.dat family_sohanad behavioral2/files/0x000d00000001c5f7-17.dat family_sohanad behavioral2/files/0x000c00000001c5fb-27.dat family_sohanad behavioral2/files/0x000c00000001c60b-56.dat family_sohanad behavioral2/files/0x000c00000001c60c-59.dat family_sohanad behavioral2/files/0x000c00000001c60e-61.dat family_sohanad behavioral2/files/0x000c00000001c60f-65.dat family_sohanad behavioral2/files/0x000c00000001c610-68.dat family_sohanad behavioral2/files/0x000c00000001c61c-84.dat family_sohanad behavioral2/files/0x000c00000001c61c-463.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jzsztricgj.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jzsztricgj.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jzsztricgj.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jzsztricgj.exe - Executes dropped EXE 5 IoCs
pid Process 6084 jzsztricgj.exe 6052 oruwrsszoojugwj.exe 912 cddysmfl.exe 4852 iblzettnzvpof.exe 5852 cddysmfl.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jzsztricgj.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "iblzettnzvpof.exe" oruwrsszoojugwj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wdqjwlak = "jzsztricgj.exe" oruwrsszoojugwj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\epsnsmdw = "oruwrsszoojugwj.exe" oruwrsszoojugwj.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: jzsztricgj.exe File opened (read-only) \??\r: cddysmfl.exe File opened (read-only) \??\v: cddysmfl.exe File opened (read-only) \??\m: jzsztricgj.exe File opened (read-only) \??\p: jzsztricgj.exe File opened (read-only) \??\w: cddysmfl.exe File opened (read-only) \??\u: jzsztricgj.exe File opened (read-only) \??\w: jzsztricgj.exe File opened (read-only) \??\n: cddysmfl.exe File opened (read-only) \??\p: cddysmfl.exe File opened (read-only) \??\v: cddysmfl.exe File opened (read-only) \??\k: cddysmfl.exe File opened (read-only) \??\o: cddysmfl.exe File opened (read-only) \??\h: jzsztricgj.exe File opened (read-only) \??\l: jzsztricgj.exe File opened (read-only) \??\r: jzsztricgj.exe File opened (read-only) \??\t: jzsztricgj.exe File opened (read-only) \??\q: cddysmfl.exe File opened (read-only) \??\n: cddysmfl.exe File opened (read-only) \??\y: cddysmfl.exe File opened (read-only) \??\a: cddysmfl.exe File opened (read-only) \??\y: cddysmfl.exe File opened (read-only) \??\q: cddysmfl.exe File opened (read-only) \??\u: cddysmfl.exe File opened (read-only) \??\a: jzsztricgj.exe File opened (read-only) \??\d: jzsztricgj.exe File opened (read-only) \??\i: jzsztricgj.exe File opened (read-only) \??\z: jzsztricgj.exe File opened (read-only) \??\g: cddysmfl.exe File opened (read-only) \??\j: cddysmfl.exe File opened (read-only) \??\l: cddysmfl.exe File opened (read-only) \??\s: cddysmfl.exe File opened (read-only) \??\t: cddysmfl.exe File opened (read-only) \??\w: cddysmfl.exe File opened (read-only) \??\z: cddysmfl.exe File opened (read-only) \??\l: cddysmfl.exe File opened (read-only) \??\g: jzsztricgj.exe File opened (read-only) \??\n: jzsztricgj.exe File opened (read-only) \??\b: cddysmfl.exe File opened (read-only) \??\h: cddysmfl.exe File opened (read-only) \??\k: cddysmfl.exe File opened (read-only) \??\o: jzsztricgj.exe File opened (read-only) \??\j: cddysmfl.exe File opened (read-only) \??\t: cddysmfl.exe File opened (read-only) \??\q: jzsztricgj.exe File opened (read-only) \??\s: jzsztricgj.exe File opened (read-only) \??\d: cddysmfl.exe File opened (read-only) \??\m: cddysmfl.exe File opened (read-only) \??\u: cddysmfl.exe File opened (read-only) \??\m: cddysmfl.exe File opened (read-only) \??\a: cddysmfl.exe File opened (read-only) \??\g: cddysmfl.exe File opened (read-only) \??\b: jzsztricgj.exe File opened (read-only) \??\y: jzsztricgj.exe File opened (read-only) \??\h: cddysmfl.exe File opened (read-only) \??\x: cddysmfl.exe File opened (read-only) \??\j: jzsztricgj.exe File opened (read-only) \??\d: cddysmfl.exe File opened (read-only) \??\i: cddysmfl.exe File opened (read-only) \??\p: cddysmfl.exe File opened (read-only) \??\s: cddysmfl.exe File opened (read-only) \??\z: cddysmfl.exe File opened (read-only) \??\v: jzsztricgj.exe File opened (read-only) \??\i: cddysmfl.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jzsztricgj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jzsztricgj.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/6164-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c5fa-5.dat autoit_exe behavioral2/files/0x002a0000000116ed-11.dat autoit_exe behavioral2/files/0x000d00000001c5f7-17.dat autoit_exe behavioral2/files/0x000c00000001c5fb-27.dat autoit_exe behavioral2/files/0x000c00000001c60b-56.dat autoit_exe behavioral2/files/0x000c00000001c60c-59.dat autoit_exe behavioral2/files/0x000c00000001c60e-61.dat autoit_exe behavioral2/files/0x000c00000001c60f-65.dat autoit_exe behavioral2/files/0x000c00000001c610-68.dat autoit_exe behavioral2/files/0x000c00000001c61c-84.dat autoit_exe behavioral2/files/0x000c00000001c61c-463.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\oruwrsszoojugwj.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File created C:\Windows\SysWOW64\cddysmfl.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\cddysmfl.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification C:\Windows\SysWOW64\jzsztricgj.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\oruwrsszoojugwj.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File created C:\Windows\SysWOW64\iblzettnzvpof.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\iblzettnzvpof.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jzsztricgj.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cddysmfl.exe File created C:\Windows\SysWOW64\jzsztricgj.exe 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cddysmfl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cddysmfl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cddysmfl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cddysmfl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cddysmfl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cddysmfl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cddysmfl.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe cddysmfl.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe cddysmfl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe cddysmfl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe cddysmfl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe cddysmfl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jzsztricgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oruwrsszoojugwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cddysmfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iblzettnzvpof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cddysmfl.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jzsztricgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302D0D9D5182556D4177D2702F2CDD7DF264AA" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABAF9CDFE13F2E7840B3A4281983EE2B08002FB4362023CE1C945E708A0" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B12E479538EB52CDBAA63293D7CA" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F66BB1FF1C21A9D10ED0A28A789161" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1845C70E14E1DAB5B9BE7CE9EDE537CE" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FFFC482C821B913DD6587E91BDE3E641584166476331D7E9" 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\Local Settings 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jzsztricgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jzsztricgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jzsztricgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jzsztricgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jzsztricgj.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4976 WINWORD.EXE 4976 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 5852 cddysmfl.exe 5852 cddysmfl.exe 5852 cddysmfl.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6052 oruwrsszoojugwj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 6084 jzsztricgj.exe 912 cddysmfl.exe 912 cddysmfl.exe 912 cddysmfl.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 4852 iblzettnzvpof.exe 5852 cddysmfl.exe 5852 cddysmfl.exe 5852 cddysmfl.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6164 wrote to memory of 6084 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 89 PID 6164 wrote to memory of 6052 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 90 PID 6164 wrote to memory of 912 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 91 PID 6164 wrote to memory of 4852 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 92 PID 6164 wrote to memory of 4976 6164 2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe 93 PID 6084 wrote to memory of 5852 6084 jzsztricgj.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ea5a41a0e1680d133f62d9ad4c6d4db6_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6164 -
C:\Windows\SysWOW64\jzsztricgj.exejzsztricgj.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cddysmfl.exeC:\Windows\system32\cddysmfl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5852
-
-
-
C:\Windows\SysWOW64\oruwrsszoojugwj.exeoruwrsszoojugwj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6052
-
-
C:\Windows\SysWOW64\cddysmfl.execddysmfl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:912
-
-
C:\Windows\SysWOW64\iblzettnzvpof.exeiblzettnzvpof.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4852
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4976
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 73df2410c727ccaeae8a8c75c287db38e6fc902285ab227e732e82d8e5c7647a
- MD5 5361759c1d1a9dfe70de9dba220d2be2
- SHA1 1700814453a16790c9be20d58a02bc581421c153
- SHA512 424be5b2f980f49b06d17d7812642b255283d0e11c9e30fcb8905643d81f63b51f0a8708b44a63e9a81f025581a9b4ec2c4409e282a92307056648cb220095b9
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T108B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 b3a6567bd9f220d7cdcbe593b61690754d12b7783fae66bffa9e3cab1ebfccbe
- MD5 243f3852ea8caae37c772441105b5eb4
- SHA1 654603570691c8e7fe8abbd74c30ab0e36948d20
- SHA512 d73e77088157781f7f145e8ab97859362dfac3b7d69d119afdffb0f1be862861ff9208cee12140b8275005c9eefd5de440356b11c1a3cf9e8258ae5568122333
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- TLSH T13EB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDBF4F.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 366B
- SHA256 9eac432b3c8adf8df0f892b95419d4252cb636d14b68ac957116af76b5a54921
- MD5 81da84b8801cf740a8a230666b90b6bf
- SHA1 539539b91e1ed3971fde6c39352f4e95342c2f6e
- SHA512 4a52011a5c0635834826c110dd3a46bd9e1ff0a3d9cc5412f10c6773b142efb7ed1c61670677dea7034a074b0a29dab68b549f7d876c71dccd3be1ceaf7df03d
- TLSH T177E046973710EBF613BE52283EF91DC49BF18CE8D36D000109DEACAA1C208C355D7A4A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D8CIRND4FBRJZUC7WDPH.temp
- Size 3KB
- SHA256 9245ca7211cb3f6d9a4002bad17cf00b7be93d1161db932e4d6035f6eb1f27fc
- MD5 be36667859ec38cdac0f101a47ba88e5
- SHA1 29a138963cd4075fa9769c07484fe629dc8305a1
- SHA512 4482d651a0ba72c1305a10280c32094cf82adca26a5457a9e48a2a3c53aba8d3de4d9acbd3496345b236221a2f72be896fa55773b786e1d31d16de4e89580f70
- TLSH T11B71BF5106AB6F5FE0E4037E522E9345DBB17C13DB05574EA2D0722F6C79E409EC8A1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 bd618f943f282f8e0b26c701f0f05952739441ee18b91a21bb8b2c6947de0cad
- MD5 f875fa2a3d18d768ff46a2912925ebfa
- SHA1 6412a0c6b3bfbfe493197e26d52fa7d2a74e5f35
- SHA512 f19f805d9b28820630c006c0d913383f04977159e7081d526ac8e1a389b578aac48c4fdb536539cdac88a7cfa9ecd735c2c0fe237192772c2fcc333a797ae08a
- TLSH T1C351B09116AF2F5FE0E403BE562E9345D7B17C13DB05634EE6D0622F6C35E409E88E1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\ConvertTest.doc.exe
- Size 512KB
- SHA256 6fcf5208f5c04c502b04d639231b245abf9d471b6c6708040f70727559e6f306
- MD5 15b87ddb208dff0107222e1f79396f37
- SHA1 97986b4e075c6e440ab6c79c6ef6aad47d00e1dc
- SHA512 3c9ef25b63fc76d3f9537886dab8a0c2459b8bec6924dce15d3dbf227052d5a427516a7ae1471cb1423eb27e023b44cfc6f91ac6fa10057aedd19f381ac69c59
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e
- TLSH T14AB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\cddysmfl.exe
- Size 512KB
- SHA256 00a4147f7a2762cf9963c8f0c25cc2afb13a303bf3b72c65834c546dda4cd7a4
- MD5 67b7116e179f8b1fb0572e06a0ea6940
- SHA1 2fa5750b77791ed22ec86685e2309ce01686022d
- SHA512 bc6356cddcc00c395c20be6b2f223362633f6ed6cead50df3cf4d31601dd5180cb8ddfb0610fe7a23ef65dd0e0eabc38affb50a3c1036a565ca8b7e8e9cf92bc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- TLSH T1EAB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\iblzettnzvpof.exe
- Size 512KB
- SHA256 32f0b06eae268d02e743ceee26b0299970415fd08ffe2ac958980c52d9149fee
- MD5 fbbbb6e622c334c8ac37a65f481abaac
- SHA1 31f38ae28da2a76853cf01ec34085f195b1922c6
- SHA512 df96b79dcfbe9a589a83498bccf827a8fe594144c6ff261a1cc39d94ef1ac6cd29f347d22fcbeb51c3845e0b458d1cb6b4d90daea5839efff17d8f155631e604
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52
- TLSH T142B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\jzsztricgj.exe
- Size 512KB
- SHA256 3591d9e3cd052995af5192e669564fd0cdff539a8c9eef0aaa96e9e00af0ea1f
- MD5 1edfe55fa455010ab03a7e78eac8bf49
- SHA1 ba65b4d59f5b7a8b88220c12795b81ef18f91531
- SHA512 52fb92ce2f489179eb7013b8550671de1e031f8a6fcd3471030aec399281028ee464dff77734fe6261ab6529cdd93ecf0d4d2bcd0cbee8a990ecadba9ad06796
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T15AB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\oruwrsszoojugwj.exe
- Size 512KB
- SHA256 ce379edbc939a4492d622c1f038dbcb13cbda3a0fc1dd237791086a17f7ff282
- MD5 a089fab2df0e59d7b7e7ef5135e63a5a
- SHA1 8b734c224153c98e956e33ad9bc7a7039acb12c4
- SHA512 518f728e4eb07f94904cb2c7aa57912abce12a383911f14613968820e9bf7a9bf3b8a82b41e1d90690f7125e2e1472694109f992cc82a8f4732b98925ac3117a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T13EB4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Roaming\GrantRead\SuspendResolve.doc.exe
- Size 512KB
- SHA256 77c40782e21f2ccf5a7e6dfa3322e3af8a28cbe5a3dea80d1a69fa36c2ec1f6e
- MD5 dbadc416bd2a4bfca59337c1cc69bf1b
- SHA1 a8d9501ca5fa310506c094f6ca62d6af0a5163dc
- SHA512 6d5c0ea33d3f67e987d460fc0ce97d7f33d4db5245b9d677fb12391dc22c284c63c8e62221f6a5db22730cd5ac774d643f675d1a85b94e4bbc3ca85cf0054a7b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T148B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\Desktop\SaveResume.doc.exe
- Size 512KB
- SHA256 10a5213c755f14ba2ecb75fd5b8070f5b446ad03df84bfd5ebb022e11ed03259
- MD5 90059c011fa86fc8a321f7630c222b8b
- SHA1 1508c1ea64a38decfc41808372a1a232de8a84fa
- SHA512 5cdc38091115e6f631b363bc58ae2e7176654cfd4b4180289ccc34ccffb914a9e53886913747f17290da359db80d1c04ee13aa51488bbe3662d53bbec72e1bde
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- TLSH T196B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 fe2ee6aaa2ee6f7b855cfc5dfd84ca58d392c2505a6a09855b30a6e84fe6acfe
- MD5 664023f8b80d2f01ab17b5af00eb92cc
- SHA1 857cb8c59c9ad8de67a2b193f7b3baf38bbf8e34
- SHA512 a695f26e91457216e60254e1e1177c072e3bbc33832999f8e85eadde1052bd2b1fcdcfce4946e59775e50ab2eacd71f409998cf1bff02b1ac40e1c738f0bd5bc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T1D8B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d2e174042c6ee2057e00a79ad86f371e69ba3bf631e4c9cd1f66df021d1d2417
- MD5 7f279ae765404005ace52eb086ba9f28
- SHA1 38a569eb0a2e7f475cf3c02a91a81cb4d24c1d5f
- SHA512 9464dc9c6961c3ecdc4a066ec5e609cc07a482f5d8dedc99ceb719f4338f01f1840ab3418be093b4744d65a774833753488b5a18d6bc4ea006824812ac251e50
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj64:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- TLSH T183B4AE2276E1B0B2E96325F00F76D738A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH