Analysis
- max time kernel
125s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:22
Behavioral task
behavioral1
Sample
tmpggakvmnv.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpggakvmnv.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpggakvmnv.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target tmpggakvmnv.exe
- Size 704KB
- Sample260602-ctr1jsc12n
- SHA256 5ec6150b0651aa8e84bd32475facb475d01b3de2f32c31834e28bac15e94e334
- MD5 38921408071168cde3467d86c03741bb
- SHA1 a7e5db313ca23c52593f55c7b0abfdb9be4825c2
- SHA512 1f35059ee84581f6ec2fd09871de221de570f754a5b727314198173cc9a6c589bc61f18c131ca9b46b32f33b3373c84f698af7479c6e1aa1761e0b00c59e5001
- SSDEEP 12288:PXgvmzFHi0mo5aH0qMzd5807FXPJQPDHvd:PXgvOHi0mGaH0qSdPFx4V
- TLSH T1DFE4C03AB780C8F2C485803176996E136EF56C301624FA6BDB64DE092EF51E5D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zafrw.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpggakvmnv.exe - Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "dqhfwmyolxdnjnsyl.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqhfwmyolxdnjnsyl.exe" zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "masrjanecpwhejpwkf.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "dqhfwmyolxdnjnsyl.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "dqhfwmyolxdnjnsyl.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xahvcik = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wcmdnwbkaf = "kauvpixqqfobahpyolgw.exe" zafrw.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe - Executes dropped EXE 2 IoCs
pid Process 2156 zafrw.exe 4748 zafrw.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager zafrw.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys zafrw.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc zafrw.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power zafrw.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys zafrw.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc zafrw.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "masrjanecpwhejpwkf.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqhfwmyolxdnjnsyl.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "xmffyqewvjrdbhowlhb.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqhfwmyolxdnjnsyl.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "dqhfwmyolxdnjnsyl.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "kauvpixqqfobahpyolgw.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "masrjanecpwhejpwkf.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "wiyvlalawhmvqtxc.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "zqlnicsmndnbbjsctrnez.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "kauvpixqqfobahpyolgw.exe" tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqhfwmyolxdnjnsyl.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "xmffyqewvjrdbhowlhb.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "dqhfwmyolxdnjnsyl.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "xmffyqewvjrdbhowlhb.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "wiyvlalawhmvqtxc.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "xmffyqewvjrdbhowlhb.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\owibnyfqipqv = "zqlnicsmndnbbjsctrnez.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "wiyvlalawhmvqtxc.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nwjdqckwpxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "dqhfwmyolxdnjnsyl.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kauvpixqqfobahpyolgw.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xmffyqewvjrdbhowlhb.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqlnicsmndnbbjsctrnez.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "zqlnicsmndnbbjsctrnez.exe ." tmpggakvmnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\masrjanecpwhejpwkf.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryjbmwcmdjj = "wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "dqhfwmyolxdnjnsyl.exe ." zafrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oymhvireyhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dirhqyckz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe ." zafrw.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\mqynvcfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wiyvlalawhmvqtxc.exe" zafrw.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpggakvmnv.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zafrw.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyip.everdot.org 2 whatismyipaddress.com 2 www.showmyipaddress.com 2 www.whatismyip.ca - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File created C:\Windows\SysWOW64\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File opened for modification C:\Windows\SysWOW64\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe File created C:\Windows\SysWOW64\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe File opened for modification C:\Program Files (x86)\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File created C:\Program Files (x86)\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File opened for modification C:\Program Files (x86)\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File created C:\Windows\byzhiieelhxrxlaqnrtqrza.wwd zafrw.exe File opened for modification C:\Windows\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe File created C:\Windows\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem zafrw.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zafrw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpggakvmnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zafrw.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings tmpggakvmnv.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings zafrw.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe 2156 zafrw.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4748 zafrw.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2156 zafrw.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2156 1308 tmpggakvmnv.exe 93 PID 1308 wrote to memory of 4748 1308 tmpggakvmnv.exe 94 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zafrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmpggakvmnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmpggakvmnv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zafrw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zafrw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpggakvmnv.exe"C:\Users\Admin\AppData\Local\Temp\tmpggakvmnv.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\zafrw.exe"C:\Users\Admin\AppData\Local\Temp\zafrw.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\zafrw.exe"C:\Users\Admin\AppData\Local\Temp\zafrw.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:4748
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:1776
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:436
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\byzhiieelhxrxlaqnrtqrza.wwd
- Size 280B
- SHA256 353891eec3a576621d4fdc718058356ad8a6b618ff4d6b0a6d5a80d5b8957d0a
- MD5 d73ffa6232cf6228fc178065043a3615
- SHA1 e1cad8cc09e6eab873d4cc31874ed2b5574c753e
- SHA512 b6b79093270cf55a2df2a2806fbaf87a647b2246c218eab6e25a599af9144a08ccdb631a4dab4087988312174531d016496eda94710913ac0c3e1501f2a8e7c7
- TLSH T110D02B07CC54557500653EF62AA92AC0A9569F412CB917087858FE22600AB09776FA65
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\byzhiieelhxrxlaqnrtqrza.wwd
- Size 280B
- SHA256 6bfda83e72e0baeed5b08493a36ff253e9d48bfccc2c001ce29641d1c3bee882
- MD5 481a450c96cacef9e9d5cad3f5c3b62f
- SHA1 e775fe21e54fa62815da0e2282d04a3c6ccf3c17
- SHA512 8e7e508c5243f52ae3351cc94d6dd4e1ac6d52bd1b2df6b8d9a0c77fe739305e458410558161c5b360afd94cb1debea9dcb7b8c2a6b470c04f61056daf25788b
- TLSH T181D02B07CC54597500613DF616A93AC0A9568F416CB917053859FE22600AB49776FA65
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zafrw.exe
- Size 1.3MB
- SHA256 fac8903834ea5f5cd1acab15ffa1e6ac5861c13341b41e14d262ed83a475d8d7
- MD5 5d8ec10718382304205b3e99cd61d4d2
- SHA1 b68ba06cdbfbac2f37422fef45cb7ce6f0616d14
- SHA512 68b82b84f9c9bc074198811fc69103bd0b6cc2ef50196653c4d0a43f3d512b5030fb6a99c67174f27adb8d1ddf7fab86b31de34370de6e74689dacd08a373a63
- SSDEEP 12288:hXgvmzFHi0mo5aH0qMzd5807FXPJQPDHvd:hXgvOHi0mGaH0qSdPFx4V
- TLSH T15255C03AB780C8F2C485803176996E136EF56C301624FA6BDB64DE092EF51E5D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\byzhiieelhxrxlaqnrtqrza.wwd
- Size 280B
- SHA256 dcd5c04c4cf733b1e1a18d9f0172878efc8a5e930fbc2ac5628b1766f4c490d7
- MD5 26ea5faed766e7e6478950b3884fd975
- SHA1 c3be63d4e157a3751c0a5fabfdffec98a8daf3fe
- SHA512 8d60d513e82674ab0c5e5af3d80e4a1070eeed849f508e050e173aeab25db9db601c3cbff3ab2150258a07ac96916fede6414fe01f94ef1623098b32cf03b235
- TLSH T1ECD02BC055A33DA53D5441AAE38610E6FA345CA21A5912D4BA40EEB1691640855DC15A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\owibnyfqipqvmllmujweqjvgnyqxyduttu.rem
- Size 4KB
- SHA256 3356ff46c0b85d6e57f56bf6ea475be00fda1be2e0a3da684296a9fb52716fb8
- MD5 1a414e85218ce48fecea5a97484bc14d
- SHA1 48cc156d5af1396bc918c890698bba2c2eb7c02f
- SHA512 1356d224cf3dd77b59694adaf28f9cc6f546fbc13710c11ed8105ab39926bf12b8e46e280f8d085989ff1b96c20c40eaa8f534437a81a82cb06395047320c6db
- SSDEEP 96:R3kFme2klzwe4VF+SowS/qmp00Jd7WzqjngxMo0KJqtjn4uQ5sPyL:R3/PcwhEg009Mo9qtjWsm
- TLSH T12D915E66FBD671BDB9A8384C0932118C321EA4663751E7E02F191751FE643CAB1F5849
- MD5 SHA1 SHA512 SSDEEP TLSH