Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:53
Behavioral task
behavioral1
Sample
tmp52_szf22.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp52_szf22.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp52_szf22.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target tmp52_szf22.exe
- Size 708KB
- Sample260602-dds4cadw6r
- SHA256 87d84f8ce2a6ca3477772aae89c328164ce5027018c200861eb1c9f49e59f7e2
- MD5 0d6d030bd997fef0fd19de0b65d221be
- SHA1 d4ab03dd4bf30cc949346beca4bdbc489d14b83f
- SHA512 88fa687aad1551846f2aefdfbb0f293d52ba1a3a5f44f02ee22fed9d8e096d1135dab62bad9f60aedacfd774fab8eba4b7c79b2db938b7b4803b0b41d9c723da
- SSDEEP 12288:DXgvmzFHi0mo5aH0qMzd5807FsPJQPDHvd:DXgvOHi0mGaH0qSdPFG4V
- TLSH T1B4F4B03AB780C8F2C485803276996E136EF56C701624EA57DB64CE093EF91E4D72A74F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmp52_szf22.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" djgox.exe - Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe" tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "hzicxhzrkxdnjnsyl.exe" tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "ojvsqdytpfobahpyolkf.exe" djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp52_szf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "dzmkjxtpmdnbbjsctrrna.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alnaorcnzf = "qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bjisddl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe" djgox.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp52_szf22.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe Set value (int) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe - Executes dropped EXE 2 IoCs
pid Process 4000 djgox.exe 1640 djgox.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power djgox.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys djgox.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc djgox.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager djgox.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys djgox.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc djgox.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "qjtokvohbpwhejpwkf.exe" tmp52_szf22.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "dzmkjxtpmdnbbjsctrrna.exe ." tmp52_szf22.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "dzmkjxtpmdnbbjsctrrna.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "dzmkjxtpmdnbbjsctrrna.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "dzmkjxtpmdnbbjsctrrna.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "dzmkjxtpmdnbbjsctrrna.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe" tmp52_szf22.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "ojvsqdytpfobahpyolkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "hzicxhzrkxdnjnsyl.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe ." tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "bvgczlfzujrdbhowlhf.exe ." tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "bvgczlfzujrdbhowlhf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe ." tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "arzsmvmdvhmvqtxc.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "bvgczlfzujrdbhowlhf.exe" tmp52_szf22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "arzsmvmdvhmvqtxc.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\shnewdshxhkrkl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvgczlfzujrdbhowlhf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "bvgczlfzujrdbhowlhf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ojvsqdytpfobahpyolkf.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "bvgczlfzujrdbhowlhf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "qjtokvohbpwhejpwkf.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rfkarxlzoxzfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arzsmvmdvhmvqtxc.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sfjyotgthpqv = "arzsmvmdvhmvqtxc.exe ." djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "bvgczlfzujrdbhowlhf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hrsertdny = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe ." djgox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "hzicxhzrkxdnjnsyl.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\vhkynrdpcjj = "ojvsqdytpfobahpyolkf.exe" djgox.exe Set value (str) \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\qzzkwxgp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dzmkjxtpmdnbbjsctrrna.exe" djgox.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp52_szf22.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmp52_szf22.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" djgox.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyipaddress.com 2 www.showmyipaddress.com 2 www.whatismyip.ca 2 whatismyip.everdot.org - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe File opened for modification C:\Windows\SysWOW64\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe File created C:\Windows\SysWOW64\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe File opened for modification C:\Windows\SysWOW64\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe File opened for modification C:\Program Files (x86)\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe File created C:\Program Files (x86)\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe File opened for modification C:\Program Files (x86)\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe File created C:\Windows\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk djgox.exe File opened for modification C:\Windows\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe File created C:\Windows\ilfkqlorvtkfmbriglsvpuav.bfd djgox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp52_szf22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djgox.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djgox.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings tmp52_szf22.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings djgox.exe Key created \REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings djgox.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe 4000 djgox.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1640 djgox.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4000 djgox.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4168 wrote to memory of 4000 4168 tmp52_szf22.exe 93 PID 4168 wrote to memory of 1640 4168 tmp52_szf22.exe 94 - System policy modification 1 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" djgox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmp52_szf22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" djgox.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmp52_szf22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" djgox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp52_szf22.exe"C:\Users\Admin\AppData\Local\Temp\tmp52_szf22.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\djgox.exe"C:\Users\Admin\AppData\Local\Temp\djgox.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\djgox.exe"C:\Users\Admin\AppData\Local\Temp\djgox.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:1640
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:4416
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:220
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ilfkqlorvtkfmbriglsvpuav.bfd
- Size 280B
- SHA256 9c262d32912cf3f63ffc47a8b3e16dfda1c9013d74ba1fb85392646008451f5e
- MD5 d6528a8eaa302e1660ba6ab68f3dcf68
- SHA1 e09d32ad5a417e6ad0750bb066989e26bb651cce
- SHA512 5ec3ce84cf53aaa6c57d3a806b691c5ba2773ff0acf4862a735c178d3b2ce6c114a90c4957b8f65f145d7996d46101111ea362e42857fc9a02eacab32c0388ad
- TLSH T1FBD02B0504346B79810EB5D53C1D1BE128E1BBA3027C42E04734E51F5C62BF8FDA08A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ilfkqlorvtkfmbriglsvpuav.bfd
- Size 280B
- SHA256 2455b704d85a6a73a216e0f19782dc1fa1b7f59fab9fd229d91cb3ad98b5816c
- MD5 ae256f355d897f29d3027eb72d5667fb
- SHA1 f927b64cb9fa18eca7a04a013c73170d5a994a36
- SHA512 0c973628ddb6d4460916fc8d235aa27a032677f4b912620b4c07f9d6daa54e99e9d6707228639c632ae032f07fbafd7926bb77762157ae1a75fa07351b1799a9
- TLSH T1EED0C24904246A79810EB4D52C1E1BE128A1AB66027842904724A50F8C62AF8F9A09A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ilfkqlorvtkfmbriglsvpuav.bfd
- Size 280B
- SHA256 7f2e1c301b17dd157b13f6fb181715f86a89aa21cef759727d7c85716c3fa284
- MD5 fbb686f861462ea6bccdacc049408805
- SHA1 8d7339ef1eda1cec937e7ae27620dc594588ae82
- SHA512 ab4858cb31d0265983e73d93b24ba72d993c2be0760d2ec9211201b8fb218813297f052012af8caa600721351e3f3a56fa8dbb16c1d435e4c0f8ff1676679ac3
- TLSH T155D02B0504746B79811AB4D53C5E1FE128E56F63427C52904735E50E4C62BF8FDA48A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\djgox.exe
- Size 1.2MB
- SHA256 0816a0c23e067a9c96c1d52d1884ecd81743060f6da05e1d030df170afb3bbee
- MD5 dfdbee5aaf2aaadcff3cfa5c1bf499c4
- SHA1 32bcbff09a9469128142082c0e3dbfc4895c5b8f
- SHA512 ba27cf2eb3207bf763982ad4d844046a9fb849bff468c7c4b2a597dbd3c88ed96ce6804e8c7919c70fd7452f5c3a18f4d816d5c563d672b20f530029bff92f8d
- SSDEEP 12288:rXgvmzFHi0mo5aH0qMzd5807FsPJQPDHvd:rXgvOHi0mGaH0qSdPFG4V
- TLSH T1C055B03AB780C8F2C485803276996E136EF56C701624EA57DB64CE093EF91E4D72A74F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\ilfkqlorvtkfmbriglsvpuav.bfd
- Size 280B
- SHA256 dff8ab0cf20c8e9ad7fcf17c31589178a853721373c8e4ab579ec81ae20f7e22
- MD5 35267132a4308a2aceee37e3a791ee02
- SHA1 026bf13cc83572e64cfe716a20850fcf34e1cb39
- SHA512 a127705ec75cf5f7324a2da70547f3ee71ee1cc30dbeaf6458d62578b9942bc93c6b1ca60d55af2902031074c8651543491d01abbe30ca57196b1125b7b7c225
- TLSH T18FD07DF83543E4A3F81492325DA4028488502D1101CF61038333714085950088191C3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\rfkarxlzoxzfxxyajzrfkarxlzoxzfxxyaj.rfk
- Size 4KB
- SHA256 097e62e1c540137c34ee922b65941b5b3c76d3f5ca7ad57cfa8ce0ed5a468f54
- MD5 f5d162f8a11d9413a3478ba52f20673d
- SHA1 73009294dfea89f42d88f496c3a1147dce8e766a
- SHA512 56fb7ea9606f6f3bdfb21cbbff4902fb1a3f2e66c8fc9d738a68400155273e3cef8fcfcdadea208acc9166cd3520bdefb1e8a08b09b550aec902844ca60e9d93
- SSDEEP 96:ujxP3JBYoXSaz4PFwh3yhxusG4RcYNoqJ/c9u13Ti:uNP/7Vz4dwdUu2RU9u1W
- TLSH T186917DCEC0DBCA7A0D5E35E456F5035B52A50B9E31133BA234810E8E3B41479EB036B9
- MD5 SHA1 SHA512 SSDEEP TLSH