Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 00:43
Behavioral task
behavioral1
Sample
2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe
- Size 512KB
- Sample260720-a2zz1sat7l
- SHA256 8f0c26acec05ba3b4ac6c78825bf5a623f2e3c596890ff741b19212120c7523c
- MD5 b7ed2399245ddb706c1f7102a22c78f6
- SHA1 de3b287ef2e42269b9a505b311cfbef3c6fcf72a
- SHA512 2c339de82cf0928627f58365531a869f3cd0f63e99212cc0d6a861ef8c28e5fcb01e23bbb0a62b03f0b8b9167367ce962ab8ae3336fc3592e854e9b2d15b7e62
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- TLSH T1B1B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 10 IoCs
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat family_sohanad behavioral2/files/0x000800000001b85f-12.dat family_sohanad behavioral2/files/0x000e00000001c45a-17.dat family_sohanad behavioral2/files/0x000d00000001c46b-26.dat family_sohanad behavioral2/files/0x000d00000001c481-62.dat family_sohanad behavioral2/files/0x000d00000001c482-65.dat family_sohanad behavioral2/files/0x000d00000001c483-68.dat family_sohanad behavioral2/files/0x000d00000001c484-71.dat family_sohanad behavioral2/files/0x001800000001c4b0-411.dat family_sohanad behavioral2/files/0x001800000001c4b0-427.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" aksgmjlqqa.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aksgmjlqqa.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aksgmjlqqa.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" aksgmjlqqa.exe - Executes dropped EXE 5 IoCs
pid Process 2816 aksgmjlqqa.exe 3340 vrnfdkkncptwmrg.exe 3012 ednlzlcl.exe 3352 nsjbcgfghssum.exe 1464 ednlzlcl.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aksgmjlqqa.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\psifbxuo = "aksgmjlqqa.exe" vrnfdkkncptwmrg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lcjoknda = "vrnfdkkncptwmrg.exe" vrnfdkkncptwmrg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nsjbcgfghssum.exe" vrnfdkkncptwmrg.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: aksgmjlqqa.exe File opened (read-only) \??\t: aksgmjlqqa.exe File opened (read-only) \??\r: ednlzlcl.exe File opened (read-only) \??\b: ednlzlcl.exe File opened (read-only) \??\m: ednlzlcl.exe File opened (read-only) \??\y: ednlzlcl.exe File opened (read-only) \??\n: aksgmjlqqa.exe File opened (read-only) \??\s: aksgmjlqqa.exe File opened (read-only) \??\h: ednlzlcl.exe File opened (read-only) \??\u: aksgmjlqqa.exe File opened (read-only) \??\n: ednlzlcl.exe File opened (read-only) \??\v: ednlzlcl.exe File opened (read-only) \??\j: ednlzlcl.exe File opened (read-only) \??\r: ednlzlcl.exe File opened (read-only) \??\b: aksgmjlqqa.exe File opened (read-only) \??\l: ednlzlcl.exe File opened (read-only) \??\y: ednlzlcl.exe File opened (read-only) \??\q: ednlzlcl.exe File opened (read-only) \??\d: ednlzlcl.exe File opened (read-only) \??\g: ednlzlcl.exe File opened (read-only) \??\h: ednlzlcl.exe File opened (read-only) \??\z: aksgmjlqqa.exe File opened (read-only) \??\k: ednlzlcl.exe File opened (read-only) \??\u: ednlzlcl.exe File opened (read-only) \??\l: ednlzlcl.exe File opened (read-only) \??\v: aksgmjlqqa.exe File opened (read-only) \??\a: ednlzlcl.exe File opened (read-only) \??\s: ednlzlcl.exe File opened (read-only) \??\d: ednlzlcl.exe File opened (read-only) \??\m: aksgmjlqqa.exe File opened (read-only) \??\u: ednlzlcl.exe File opened (read-only) \??\w: ednlzlcl.exe File opened (read-only) \??\i: ednlzlcl.exe File opened (read-only) \??\n: ednlzlcl.exe File opened (read-only) \??\q: aksgmjlqqa.exe File opened (read-only) \??\m: ednlzlcl.exe File opened (read-only) \??\z: ednlzlcl.exe File opened (read-only) \??\k: ednlzlcl.exe File opened (read-only) \??\i: aksgmjlqqa.exe File opened (read-only) \??\o: aksgmjlqqa.exe File opened (read-only) \??\p: ednlzlcl.exe File opened (read-only) \??\x: ednlzlcl.exe File opened (read-only) \??\x: aksgmjlqqa.exe File opened (read-only) \??\o: ednlzlcl.exe File opened (read-only) \??\q: ednlzlcl.exe File opened (read-only) \??\t: ednlzlcl.exe File opened (read-only) \??\x: ednlzlcl.exe File opened (read-only) \??\w: ednlzlcl.exe File opened (read-only) \??\a: aksgmjlqqa.exe File opened (read-only) \??\s: ednlzlcl.exe File opened (read-only) \??\v: ednlzlcl.exe File opened (read-only) \??\z: ednlzlcl.exe File opened (read-only) \??\g: aksgmjlqqa.exe File opened (read-only) \??\w: aksgmjlqqa.exe File opened (read-only) \??\y: aksgmjlqqa.exe File opened (read-only) \??\a: ednlzlcl.exe File opened (read-only) \??\t: ednlzlcl.exe File opened (read-only) \??\d: aksgmjlqqa.exe File opened (read-only) \??\h: aksgmjlqqa.exe File opened (read-only) \??\l: aksgmjlqqa.exe File opened (read-only) \??\b: ednlzlcl.exe File opened (read-only) \??\k: aksgmjlqqa.exe File opened (read-only) \??\r: aksgmjlqqa.exe File opened (read-only) \??\i: ednlzlcl.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" aksgmjlqqa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" aksgmjlqqa.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4500-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000d00000001c46a-5.dat autoit_exe behavioral2/files/0x000800000001b85f-12.dat autoit_exe behavioral2/files/0x000e00000001c45a-17.dat autoit_exe behavioral2/files/0x000d00000001c46b-26.dat autoit_exe behavioral2/files/0x000d00000001c481-62.dat autoit_exe behavioral2/files/0x000d00000001c482-65.dat autoit_exe behavioral2/files/0x000d00000001c483-68.dat autoit_exe behavioral2/files/0x000d00000001c484-71.dat autoit_exe behavioral2/files/0x001800000001c4b0-411.dat autoit_exe behavioral2/files/0x001800000001c4b0-427.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ednlzlcl.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll aksgmjlqqa.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ednlzlcl.exe File created C:\Windows\SysWOW64\aksgmjlqqa.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File created C:\Windows\SysWOW64\nsjbcgfghssum.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\nsjbcgfghssum.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification C:\Windows\SysWOW64\aksgmjlqqa.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File created C:\Windows\SysWOW64\vrnfdkkncptwmrg.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\vrnfdkkncptwmrg.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ednlzlcl.exe 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ednlzlcl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ednlzlcl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ednlzlcl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ednlzlcl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ednlzlcl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ednlzlcl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ednlzlcl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ednlzlcl.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification C:\Windows\mydoc.rtf 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ednlzlcl.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ednlzlcl.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ednlzlcl.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ednlzlcl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aksgmjlqqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnfdkkncptwmrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ednlzlcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nsjbcgfghssum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ednlzlcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422C0A9D5183586A3176A170532DDF7C8F64D8" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B12E47E039EE52C4BAA532EFD7CA" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFCFF482A85139142D7207D93BD95E143584466446244D799" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" aksgmjlqqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" aksgmjlqqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat aksgmjlqqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc aksgmjlqqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAF9CDF963F1E483743B4A86E939E6B08C038D4213023EE1BA459B08D4" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC60B1591DAB4B8CF7C93EDE534C8" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" aksgmjlqqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F168B6FE6D21DED272D1A68B7C9165" 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg aksgmjlqqa.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4832 WINWORD.EXE 4832 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 1464 ednlzlcl.exe 1464 ednlzlcl.exe 1464 ednlzlcl.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 2816 aksgmjlqqa.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3340 vrnfdkkncptwmrg.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3352 nsjbcgfghssum.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 3012 ednlzlcl.exe 1464 ednlzlcl.exe 1464 ednlzlcl.exe 1464 ednlzlcl.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE 4832 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4500 wrote to memory of 2816 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 89 PID 4500 wrote to memory of 3340 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 90 PID 4500 wrote to memory of 3012 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 91 PID 4500 wrote to memory of 3352 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 92 PID 4500 wrote to memory of 4832 4500 2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe 93 PID 2816 wrote to memory of 1464 2816 aksgmjlqqa.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_b7ed2399245ddb706c1f7102a22c78f6_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\aksgmjlqqa.exeaksgmjlqqa.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\ednlzlcl.exeC:\Windows\system32\ednlzlcl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1464
-
-
-
C:\Windows\SysWOW64\vrnfdkkncptwmrg.exevrnfdkkncptwmrg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3340
-
-
C:\Windows\SysWOW64\ednlzlcl.exeednlzlcl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3012
-
-
C:\Windows\SysWOW64\nsjbcgfghssum.exensjbcgfghssum.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3352
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4832
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 20c03422b3c5fb0c1e8346f2cdbc8ed45e13cecc5d881051d13b6c74ae62c80e
- MD5 4806c7b42ca7fca33547386c42154b02
- SHA1 a137133c7835a7ababb233b04612fe99030b87a7
- SHA512 ca9489c2c3de547c1a993e20839bbc71d4106d69708b0bb2fad1af9951943f6a94dfe089e4e90c05b335cc294b8b54f31356316d34a3f8fd52999a834759057b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- TLSH T150B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCD7176.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\ExpandAssert\DismountGrant.doc.exe
- Size 512KB
- SHA256 681f6006fe3f0d954a8d4312f111de7041caa96455287e5dddc2b6ab28caaf09
- MD5 e119db3050beafe1304243a512246536
- SHA1 307356f37f07b9933b7887649fca2995608f53f2
- SHA512 3b8d9e5e79f5b91510b2b63083c3c055c322dc4c45158c59b99efa42a8fae376d329430345efe5c24fdac5489fe8ff757d331bb6cb64bdee714c28d8e8de33eb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T131B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\LockClear\ResolveMeasure.doc.exe
- Size 512KB
- SHA256 b8476c10509fe1641164a5fc980cd632230f470ec4548b8d70125f10b6577de3
- MD5 3f8820b217dc548d186a4a224e85f617
- SHA1 295877ef40e62ca6602f5d950628543a6e90daab
- SHA512 adb0e18baf6578e8e02fd4e36b865ffad52035f4028352c8d69fbf4789fd23a911b7d60a7d2183898282d8f40a97d4f67138ea05640c2268105f5c07e612ca5d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6d:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T1D2B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\LockClear\SubmitOptimize.doc.exe
- Size 512KB
- SHA256 bf51e999a4352c98ed3e450fc2515163ff88f2865fbd5119ad33a58cca5b9b64
- MD5 6bd37445c0a5e07cb6fd5ea5038cc01f
- SHA1 5a8eec7848bf1fe1936b5cb2aa072a145240d1d5
- SHA512 98db447338349d373c3fad6d4567b478f535fbb40752d65f185faa2ec965c70bd106eb672f157bddb3becd7ed7ef9a7665898b9e7beddbfd67f6d7e6d1c84957
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T112B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 218B
- SHA256 b802fd3ec6034eb4851e3abc92c8dffca5004d2b12a7c363944c4d8f01e498bf
- MD5 5351d2247b1f9f752ca8eb92ca4b2a42
- SHA1 9e28db57b7b967da4f3c0b6a8b3b1d1a3a68f9c4
- SHA512 0ca01654bf0a5ae5b32eb8abcd20255d52ea51635622d490a34fb6bfecc279b48727e9ffc76c20eab447880cf9e33a6222541ed481bb3d85f28e511cfe9f19c7
- TLSH T186D0C90B93A4C7F4877C92F475B09DF96AF2882CD0B2013227D40CC60C4215724EB105
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
- Size 18KB
- SHA256 4a33cea35831e848e731659ea6521fced2150dc5e66a61fdb1b9c4979faf4201
- MD5 e69adeb3b8bc3933e1f22c3818906a07
- SHA1 d592be1facae1b04dd3b3a0d2112d1f9757f2d78
- SHA512 b8df46c0f5dfa49fd6317dc9062dafdcdc12a722a9ab80f1b658de9038de1c369f750a73964cbaf8aa09fa90c693c54826f066fcbf035b697f44046b3e76dbfa
- SSDEEP 384:Jt+BNxt/ZtNNVuaS6jqoIFOJu64PXpIZqVEqE9rWBwZePl/Ac:exllN3/IICXOZOEqGWZ/Ac
- TLSH T1AC82AF3CE1241964DAE3457D646D12F2F11C0483B71AA4CF20AEFB9E97E8E574362F89
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 679B
- SHA256 ef888ed589ec75eae9f10ad91f657f0d80c7b6c0bd38ff3aca4b6e82a3516237
- MD5 b54f66428ea2451da0feea8e9460e4bc
- SHA1 00f42e74c6f7e4044ec866bac9eea550b7fbe86f
- SHA512 39c53cfc6538a9926050af9328360bab5bc850baa7031b800f3fa357819a696a9ca598ddcfa79f1f3809d35de3e54a498a3948a1c986e5ab38fa225de2aeda47
- TLSH T1B501C9001A55AFD6D291423A029B3731AB30FA03EA1E8E9E5208733BEEB07D05D4D1ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 24B
- SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
- MD5 4fcb2a3ee025e4a10d21e1b154873fe2
- SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
- SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\aksgmjlqqa.exe
- Size 512KB
- SHA256 3bf4f5edcc9cfc59561bcd4369e45db1979d5946f97d7668c16c90c031a730a9
- MD5 3d89d7abfbf092fd97d27ae80ba13ee6
- SHA1 c02d0f869bbb40a640ed0848165831a78c8fc72d
- SHA512 b520cb7ffb49b82e0b67a19f0e63d0012e6239931dd461d7542f614f75bdce3f4397f696f7f582223fb3944cc6f70f849c7423b299ac3736fa058fda6357d497
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- TLSH T120B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ednlzlcl.exe
- Size 512KB
- SHA256 ddb0c82a33ab32b2418a3f11648527b3dea04c965c38b348973c94145c7db485
- MD5 de9bc4fe33309767bdc056e9ff227ad9
- SHA1 aa89369523a54fa1bd1653c1e2367efbfe1e7f6b
- SHA512 67e21f38f5768545338af51cac9df8f5e4d3cf515edd840604225e557e11af9c5e9012bfac0f69bca55cf9f0afac32be15e8450735030195008abf5eac1ccddb
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6V:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Y
- TLSH T101B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nsjbcgfghssum.exe
- Size 512KB
- SHA256 dc75d7e6732d4e9991537a6b79c71402f3b29f3bb526da4ff70a8ebe06f78c0d
- MD5 3451d8b74552fa169f7fe88b6a3ca93f
- SHA1 e384cb705f0377e9ef11bee25451d806fc14c3f9
- SHA512 eaae07cbade550ee601453f9e8c920eeacad0bdc8aea241f18293917a97ddff7df05e130d14f7852d9f1349960f6b3f8e8b4a7ba832cd5c41797e25d398e7441
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj63:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M
- TLSH T178B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\vrnfdkkncptwmrg.exe
- Size 512KB
- SHA256 7202de7811b25e4713b973814ec81a4fe0ccb6a756fc674ef85f95f46b545fbf
- MD5 7a8afde30ca34a4f71e9461a90245840
- SHA1 1fb46e82d68e5bbcef7a5a72cf6c621b6804859e
- SHA512 fd3abb42c4727cf2680835aa5e2bfe5dc3f283eba4506c2d7ea0bf49458b1918d036e915a643d7a4556bf729606bf37b2e394b4e8b9e8a6cdafbccc5ffc7a96b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T19AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 496c85bfd7fd32f10bc079f4a7a08a37535744c8f0cb97e1105c79fe1c16ded8
- MD5 a4c8cc144d3cb6654010c3b1f1db83e1
- SHA1 9611c5d8f7916372c1f627933a63434847ae3ebb
- SHA512 8ef0585feb1dc4342f30e3a43e09ad60567af59607557c936da8c4cf9d8e4debb96327028fb3d45170a58bb0662027c4b79f6a9208984bdc0b735287b7a5e8f1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- TLSH T18FB4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 2603e5a94762405e9cad283c807d57b1563d7b65434d815f8e0eb8486956ee08
- MD5 536ba67b0906930333fa6abfb92512c5
- SHA1 362620769377656f7ba14b0cfc9add2db7e037e6
- SHA512 835bbeac86b272c81406e17e79a437fae739450f0afb7421567b04a8f4d6824765856a457582cc38528d6ffda0dc3bc03ec49149d22af6a49a6f208efa3a5a47
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
- TLSH T161B4AE2276E1B0B2E96325F00F76D728A777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH