Analysis
- max time kernel
112s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 02:22
Behavioral task
behavioral1
Sample
tmpggakvmnv.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpggakvmnv.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpggakvmnv.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target tmpggakvmnv.exe
- Size 704KB
- Sample260602-ctr1jsc12n
- SHA256 5ec6150b0651aa8e84bd32475facb475d01b3de2f32c31834e28bac15e94e334
- MD5 38921408071168cde3467d86c03741bb
- SHA1 a7e5db313ca23c52593f55c7b0abfdb9be4825c2
- SHA512 1f35059ee84581f6ec2fd09871de221de570f754a5b727314198173cc9a6c589bc61f18c131ca9b46b32f33b3373c84f698af7479c6e1aa1761e0b00c59e5001
- SSDEEP 12288:PXgvmzFHi0mo5aH0qMzd5807FXPJQPDHvd:PXgvOHi0mGaH0qSdPFx4V
- TLSH T1DFE4C03AB780C8F2C485803176996E136EF56C301624FA6BDB64DE092EF51E5D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tjkpdds.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpggakvmnv.exe - Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "vzohjxaqppfowozlhosha.exe" tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "vzohjxaqppfowozlhosha.exe" tjkpdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "tvizzlmaxvjqwmvfzeg.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\izbhwxnq = "gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjilx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe" tjkpdds.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation tmpggakvmnv.exe - Executes dropped EXE 2 IoCs
pid Process 2188 tjkpdds.exe 1624 tjkpdds.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys tjkpdds.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc tjkpdds.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power tjkpdds.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys tjkpdds.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc tjkpdds.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager tjkpdds.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "gjxpqdfusrgovmwhcilz.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "tvizzlmaxvjqwmvfzeg.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "tvizzlmaxvjqwmvfzeg.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "srbpmvteyteilyel.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "zzkzxhgsnjvaeszhz.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "vzohjxaqppfowozlhosha.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "tvizzlmaxvjqwmvfzeg.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "zzkzxhgsnjvaeszhz.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "gjxpqdfusrgovmwhcilz.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "zzkzxhgsnjvaeszhz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvizzlmaxvjqwmvfzeg.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "vzohjxaqppfowozlhosha.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "gjxpqdfusrgovmwhcilz.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vzohjxaqppfowozlhosha.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "tvizzlmaxvjqwmvfzeg.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe" tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tvizzlmaxvjqwmvfzeg.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gvvzml = "vzohjxaqppfowozlhosha.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\slpxorjocr = "vzohjxaqppfowozlhosha.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe ." tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ijvlkvviebouzowfyc.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhmvnrkqfvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe ." tjkpdds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kflvotnukbii = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zzkzxhgsnjvaeszhz.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gvvzml = "C:\\Users\\Admin\\AppData\\Local\\Temp\\srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zrubrtkob = "srbpmvteyteilyel.exe" tjkpdds.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tjkpdds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjxpqdfusrgovmwhcilz.exe ." tjkpdds.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tjkpdds.exe - Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 www.whatismyip.ca 52 www.showmyipaddress.com 81 whatismyip.everdot.org 91 whatismyip.everdot.org 56 www.whatismyip.ca 61 whatismyip.everdot.org 69 whatismyipaddress.com 71 www.whatismyip.ca 73 whatismyip.everdot.org - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe File created C:\Windows\SysWOW64\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe File opened for modification C:\Windows\SysWOW64\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe File created C:\Windows\SysWOW64\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe File created C:\Program Files (x86)\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe File opened for modification C:\Program Files (x86)\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe File created C:\Program Files (x86)\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe File opened for modification C:\Windows\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe File created C:\Windows\xfyvbtauxbviuqfvvgohe.cjd tjkpdds.exe File opened for modification C:\Windows\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun tjkpdds.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpggakvmnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjkpdds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjkpdds.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings tmpggakvmnv.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings tjkpdds.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings tjkpdds.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe 2188 tjkpdds.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2188 tjkpdds.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3480 wrote to memory of 2188 3480 tmpggakvmnv.exe 99 PID 3480 wrote to memory of 1624 3480 tmpggakvmnv.exe 100 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjkpdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tjkpdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tjkpdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tjkpdds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tjkpdds.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tjkpdds.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpggakvmnv.exe"C:\Users\Admin\AppData\Local\Temp\tmpggakvmnv.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\tjkpdds.exe"C:\Users\Admin\AppData\Local\Temp\tjkpdds.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\tjkpdds.exe"C:\Users\Admin\AppData\Local\Temp\tjkpdds.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
PID:1624
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:1236
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4904
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\xfyvbtauxbviuqfvvgohe.cjd
- Size 280B
- SHA256 0bc0aa366caab3b7477e380dbdc3ebc13dfe2afc4bacd3fbbcecebc4cced87c6
- MD5 d64c5bcb99c2e355268f26fcde9b0a2d
- SHA1 913fe8b5e4c751296ee516ed1c2db4bbbbe3ba2b
- SHA512 5281628d4d78a2bfb7c7ba05a380f011a02a4011daca70ebadf9ca67d020bc8a01ffd3f23cfdb61c3998160bf1798750bc7d50a5c42a5df5f2351ce88e4cc4de
- TLSH T197D0EB702A2221099D610B770FE57304A54400BA7F23023D1097C90A7A40342AF29C16
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\xfyvbtauxbviuqfvvgohe.cjd
- Size 280B
- SHA256 065799bbc6ed8f239df0a05b2a879a1f59e52b2aa256771dd1298798ebc01a20
- MD5 01688467c8fbe2c5a372db1c87b1b357
- SHA1 2cfa5c750e1aeacec3b1c5b8d22e296f6f9073b5
- SHA512 a2dba65c6703e7c0061e7d17d82094a032630f47be28865eccd07858237a1c82574a0fa18b74b2e14e7a331c1a349c74b66eaeb04f45bb32ffe0069a65bb5c99
- TLSH T110D0EB706925A60A9C210B7B0FA47314A22400EB7F27023C206BC90A7A80282BE29C05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tjkpdds.exe
- Size 1.3MB
- SHA256 9c548af0cc30a1b6f3c93595a1b77ce41edc8d543011354426a8905755cf67f7
- MD5 b8c4f4d2ecfa585361383349e570f088
- SHA1 bb5939260bf02db3e506d861b32522786cb95082
- SHA512 0c517d20f5b2f1dccf6bcb4bc2dfe7dcce0017f180571dca9c9a200667e2119cbe95d8648971940e88c3e6e07029d7398cd57cfbca631aa146fcb7610176183c
- SSDEEP 12288:oXgvmzFHi0mo5aH0qMzd5807FXPJQPDHvd:oXgvOHi0mGaH0qSdPFx4V
- TLSH T1B355C03AB780C8F2C485803176996E136EF56C301624FA6BDB64DE092EF51E5D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\slpxorjocrwuryyzkgzdlcfxcqfkifmm.yun
- Size 4KB
- SHA256 8edc32970c21803c6300ea602d82c5b6bd6fc7f08b94b947535407dce9bacda6
- MD5 147b06e17fe0a0d97df67927ab2ff2e3
- SHA1 58170f93ac719ddca8371dd39fda6143bb1770d7
- SHA512 60252a9b9c28a1221292d1f15cb3397138444f0513510eb586635af078f5d365bdd7fde18221bbf73a134a8661e3e21fc30125525c9d005ad9bca883f7ab0ca4
- SSDEEP 96:OjWZzEGlgniNZpzn7n1l//OjHBAMQmz3o/7uryqgwVUq:/EGlEWZ1nj//Oj/3a7uryXmUq
- TLSH T1F2915E6A2F084774CB5ED50D0037AD808AD1684A5C81A6A269BC1A30DD5C7FD7C77FC5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\xfyvbtauxbviuqfvvgohe.cjd
- Size 280B
- SHA256 37a0a7519e3fe201a35065891524d3440a813e102fb29111f48937c1609c38c1
- MD5 43e7e27a7bc773dec632f263ff0bbce5
- SHA1 7c0a85287e4ea0d487965976b0748fcf12c9755d
- SHA512 d7528f10f98279d3b6b96df6c51c57c97d0cd194cd22311d1e935b682a17f4128aaf53523bfab34bbc4208a5540bab70a4740d93aa147007f1ca1546e83cff88
- TLSH T1E5D0EB41C2B03328CB94EBDD0120C740B176F52CA928300AC200D4004C00BA9CF696F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\xfyvbtauxbviuqfvvgohe.cjd
- Size 280B
- SHA256 09346e1b034705b2696b8dea98ca4d64a3764ba30ce868b6f9cd6d745e76288d
- MD5 453a8833d6363233d7dfbc8b4238144a
- SHA1 b569ac6cc25737dc36b4d779605093bb036c3943
- SHA512 b377b218d07a6968ac9fcf8d5104465219b6eb0ea19b56b02d200af76441398fd831e1e83da1fa6502ef2a05fd70d7a3ab9c825a36473593a014192c4572a545
- TLSH T15DD0EBB02D2562099C230B774FA47304A20400BE7F23063C1057C90ABA80282BE29C05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\xfyvbtauxbviuqfvvgohe.cjd
- Size 280B
- SHA256 37ed3693cd833b8dfdeed81cdc9a07cb007cb07dceec2618be850a3ef1f4ba21
- MD5 d589967e59333d5e160e4b6fab01a690
- SHA1 3538ebba102b47c2234bb2e010e9ec7b4242c3ea
- SHA512 7de79c06fc941ac87e62112035870b166e9f911528bfa37d4c3c5f28eb0e431bb21def9e92fdd2c71de6816ffbdda4d299ba0997c1057e94b43558f2d7036233
- TLSH T1DED0EB7029212109DC210B770FE47344A10410AB7F33023E1457C98B7E40242EE29C16
- MD5 SHA1 SHA512 TLSH