Registry Run Key Persistence Referencing SparroWocky Loader

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

Detects the modification or creation of Windows Registry Run keys that point to specific file names commonly associated with malicious persistence, specifically winfsp-x64.dll and DukeQt.dll. This indicates an attempt to establish persistence on a compromised host by ensuring malicious code executes during the user login or system boot process.