Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 02:50
Behavioral task
behavioral1
Sample
tmp0omrvgyc.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp0omrvgyc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp0omrvgyc.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target tmp0omrvgyc.exe
- Size 320KB
- Sample260602-db116sdw3p
- SHA256 39f6f0fff5a419129816a2fdb72aa88140da16482f788485ec27ede07e030b1f
- MD5 0ecb4798de60f7fa536e85d0846bd866
- SHA1 b4a680d3c44403a3d409765810e73e1efe5bd671
- SHA512 5022dcc35ccdb598a6cbdba8f1ed904d16d7dd434047914165de059daac116cc43af1cc74b78ed5b40d883fd2294351a8f1b2bb0e2f02ea65a0683015efba43f
- SSDEEP 6144:wTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:+XgvmzFHi0mo5aH0qMzd5807FRPJQPDV
- TLSH T15664B03BB780C8F2C485803176996E136EF56C301625EA5BDB60DE0A2EF55E4D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect Pykspa worm 1 IoCs
resource yara_rule behavioral2/files/0x00070000000245cc-8.dat family_pykspa - Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmp0omrvgyc.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdlmq.exe - Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "uplasmddylrqeaobrzy.exe" wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "tleqfwkhzjmitmxh.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "uplasmddylrqeaobrzy.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "jdymdwmlfrwuhcpbqx.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\glr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe" tmp0omrvgyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hpyafm = "jdymdwmlfrwuhcpbqx.exe" wdlmq.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp0omrvgyc.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation tmp0omrvgyc.exe - Executes dropped EXE 2 IoCs
pid Process 1192 wdlmq.exe 4744 wdlmq.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc wdlmq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager wdlmq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys wdlmq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc wdlmq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power wdlmq.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys wdlmq.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "tleqfwkhzjmitmxh.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "jdymdwmlfrwuhcpbqx.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "uplasmddylrqeaobrzy.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\alxckubrc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\alxckubrc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "tleqfwkhzjmitmxh.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\alxckubrc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "tleqfwkhzjmitmxh.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "jdymdwmlfrwuhcpbqx.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdymdwmlfrwuhcpbqx.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "tleqfwkhzjmitmxh.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "atnaqixvozdamgsdr.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "uplasmddylrqeaobrzy.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdymdwmlfrwuhcpbqx.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "atnaqixvozdamgsdr.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\alxckubrc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\alxckubrc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtricyrtqfnoecshzjkhf.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\jteipyet = "wtricyrtqfnoecshzjkhf.exe ." tmp0omrvgyc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uplasmddylrqeaobrzy.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "uplasmddylrqeaobrzy.exe ." wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\udnqwej = "wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "wtricyrtqfnoecshzjkhf.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "jdymdwmlfrwuhcpbqx.exe" tmp0omrvgyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntaa = "hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdlmq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atnaqixvozdamgsdr.exe ." wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdaqjewxthoodapduddz.exe" wdlmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tfsyhsardh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tleqfwkhzjmitmxh.exe" wdlmq.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp0omrvgyc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmp0omrvgyc.exe - Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 www.showmyipaddress.com 38 whatismyip.everdot.org 39 whatismyipaddress.com 59 whatismyip.everdot.org 62 whatismyip.everdot.org 31 whatismyip.everdot.org 32 www.whatismyip.ca - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe File created C:\Windows\SysWOW64\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe File opened for modification C:\Windows\SysWOW64\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe File created C:\Windows\SysWOW64\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe File created C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe File opened for modification C:\Program Files (x86)\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe File created C:\Program Files (x86)\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe File created C:\Windows\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp wdlmq.exe File opened for modification C:\Windows\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe File created C:\Windows\bfkijmmvzvkspurnmdlpustw.fjf wdlmq.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp0omrvgyc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wdlmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wdlmq.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings tmp0omrvgyc.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings wdlmq.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings wdlmq.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe 1192 wdlmq.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4744 wdlmq.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1192 wdlmq.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4860 wrote to memory of 1192 4860 tmp0omrvgyc.exe 100 PID 4860 wrote to memory of 4744 4860 tmp0omrvgyc.exe 101 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmp0omrvgyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp0omrvgyc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmp0omrvgyc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdlmq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdlmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmp0omrvgyc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp0omrvgyc.exe"C:\Users\Admin\AppData\Local\Temp\tmp0omrvgyc.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\wdlmq.exe"C:\Users\Admin\AppData\Local\Temp\wdlmq.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\wdlmq.exe"C:\Users\Admin\AppData\Local\Temp\wdlmq.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:4744
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:4772
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5040
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 2c3f59882f88a380920a1503c7c1685fa7e3f2dff4804734beb6e081e2cb8b37
- MD5 6a8e04e127af09b80c230cff79aa3bf9
- SHA1 a582e84a559e8948df0646ada8bc480ba7afd04c
- SHA512 6efe452d9eef6a8ba8fe73af73431c6cf7dc5f16459fc24cbc3a26f809a9050b1a63d348683a6f2da9a2b12ebc26dc2856c2b0ad71645359f67784d11edde085
- TLSH T1C7D0EB50EE04A30490EC03818ACC9916D88100238F63A1EA73408815F43C21AB04CC3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 5f652ef1c66d279b77bd18f4e1bc6f435bf79603dc15b84f2cdde7151b6806f0
- MD5 10809d6c18a30e50721640a4014635f2
- SHA1 37ec49079d2af698978e28f96552ac31ec5ffb1c
- SHA512 d69a94dc6fa93d11aeee7edf403e3a9b2f93d5e89e4be945e4b7427e6079bc2ea3db982b126b0357bf30c270ce481689e34d82d3ddeeed807109a05d926ad896
- TLSH T18DD0EBA0EE04A30460EC03D08ACC9916DC8100238E23B1DAB3818820F43C21EB14CC7D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 edd18d5659aed60916b4a22f8abed828ec39ef3753b5be24491fd0d7693f2588
- MD5 5da2bf46bc25d0da62aeea13b36816f0
- SHA1 4f2a49564f3c8e905469734aa8d6926a95528146
- SHA512 ca75fd6a76734e94e4128dac040280ff3ffc931e6f1ee4f8221772e06cb58d2d27de993b0c6c7a3d56d628de20594a66d4f6597c10b5022c3de6501218a84577
- TLSH T125D0EB90EE04A30450EC03808ACC9D16D88100238F23B1DAB3418820F43C21A714CC7E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 5de48151b4f05e6e7b41b16eca03bd46f6b979d086642d900aa7dbcc090c4f7a
- MD5 11630f0e83bce373df73d56492e45855
- SHA1 d8803d9e4977c8673586d59cc88a1ede53590ea8
- SHA512 4d011761a70ce833abd7ee899cb774e7264719c4f70b8a6f1d8b2865e0eb12333fdc895046890f692a3b26b16041c5925b82b823ea04f78cd31784a6f0c5e538
- TLSH T156D0EB50EE08A30850ED03858AC8A926D8C104278F63A1D673408894F43C21AB04CC3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wdlmq.exe
- Size 684KB
- SHA256 e66346d7ff37f2a326e96c18110d2c33c0085154fc2c9f409e28504b00f6a4c8
- MD5 8b22697669ac1da48a4f38b5a66bd1b1
- SHA1 1766ec8dc486a0994fd37b263bef813bc1e12024
- SHA512 1b53b57889dbc5b310f5aaf834e296bf2b422aa5266f05bdea22bfaf43e9149c5bc923920c99f11baf1f8443d03e5c30a707af17a2c51d045f2d664fc106181f
- SSDEEP 12288:zXgvmzFHi0mo5aH0qMzd5807FuFN4PJQPDHvd:zXgvOHi0mGaH0qSdPFuFs4V
- TLSH T1D4E4B036B780C8B2C48580317699AE136EF56C301625EA67DB60DE0A3EF55E4D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 3d4cbda2f0974e3c485f2fbda8d9de84f7c905b96638b5ab2b9780d6c992fbd2
- MD5 937315161200b2dc101918eda16b7057
- SHA1 bd1505146fd59480f41790168cef8627c52f60b5
- SHA512 cf407165e80ee711dddb12fdb622701c03863978dfc164a556b6ab84fc1178b0e2faa96e3825a8b601aa9e782d1bab11e559fe4c25039a4f6b6aa17889849e58
- TLSH T148D0EB60EE04A30590EC03818AC89E16D88105238F23A1D673418815F83C21AB04CC3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 a8883a1c673af3ffb13fda335c9648849d0d611aee80f2b0ec3890adc7f17da7
- MD5 127f22ec3419905f11f8f93907c5bd60
- SHA1 6ba66007622185c2fccc2b9fb6d77a532cfe6918
- SHA512 f8f5558ed745ce17fa75c68984eb691dbb2f3f79bded0c48e9a0e4bec1a0ed82c875ebcb2d9a2210f3d923ed3424ed16562a09f212792a48b8ed5f2e34a7c84e
- TLSH T106D0EB50EF08B30460EC03858AC89A16D88100278F23A2DA73408820F43C25AB04CD3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\bfkijmmvzvkspurnmdlpustw.fjf
- Size 280B
- SHA256 a27aa75a1cda826dab93460a1ed17142ac1db7ca03c0b2129a5acea208ea807f
- MD5 147e03624ff299a432b713a724456ffa
- SHA1 b58052bf7676fc38f75f2fc17c235c0c08620ff1
- SHA512 28aa15b0f24aa36d89921742d3cc674d7a36945aca35c8c5b7b681d5a78ce9cd4beb9be9a5f1f6a94e3655942334ad67c47de1bfd7c0e204dbe3aa0788c5cc9e
- TLSH T122D0EB50BBF226A901B098EC19998A1D86A43403D7BCC8C3020C804D640C074261EE38
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\kzpykyjdszzsaqyfprkzpykyjdszzsaqyfp.kzp
- Size 4KB
- SHA256 d48d735973696690dd4e89a1cce669936e1bbf39c63ae56d20ce69f119386624
- MD5 7e075fb184f6d21a5b0341d70128a82e
- SHA1 572933f6667a982548f01161e95da7370f67119f
- SHA512 fdea1f7767983eecbf66507259a7608f5dcb4c26ffe2cc58b9bc7aa246e213a81e306796e1ecf4288bba9b6f3c2de5b4c5f47b4ad65ba47cda1ceb54860f4c11
- SSDEEP 96:hm7tMOXcAxilk1jWYEtr7FoQvq77lcY9IUGsN+PA9RgdL+dDtUUiEA9q5:hCtPXcrktWYEZ+QvIlpKUXMAfgdL+dDL
- TLSH T119918DA845EDA2EE9516CA7CD93509C748F2B1B8CA409FBD9A704F008C27736047DB31
- MD5 SHA1 SHA512 SSDEEP TLSH