Kimsuky NUKESPED zlrenu8.exe Registry Enumeration of CurrentVersion\Windows
Detects the NUKESPED backdoor component 'zlrenu8.exe' interacting with the 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' registry key. This activity is consistent with malware performing environment profiling or establishing persistence by targeting registry keys used for automatic startup.
YARA-L
