Multi-License Discount Quote

Change Region

English
Threat Database HEUR Malware HEUR.Malware.Babel.Generic

HEUR.Malware.Babel.Generic

By CagedTech in HEUR Malware, Malware

Threat Scorecard

Popularity Rank: 5,629
Threat Level: 100 % (High)
Infected Computers: 917
First Seen: January 7, 2013
Last Seen: July 15, 2026
OS(es) Affected: Windows

The detection of HEUR.Malware.Babel.Generic indicates that your system has been compromised by a potentially malicious program. This type of threat is categorized as a Trojan, which is a broad term for malware that disguises itself as legitimate software. Trojans can cause significant harm to your system and data, making it essential to understand the nature of this threat and take immediate action to remove it.

What Is HEUR.Malware.Babel.Generic?

HEUR.Malware.Babel.Generic is a generic detection name assigned by security software to a type of malware that exhibits characteristics of a Trojan. The "HEUR" prefix indicates that the malware was detected using heuristic analysis, which involves identifying patterns and behaviors that are typical of malicious programs. The "Babel" part of the name may suggest that the malware is capable of communicating with its creators or other malicious entities in a way that is not easily understood or decoded. Since specific details about this malware are not available, it's crucial to focus on general guidance for removal and prevention.

How HEUR.Malware.Babel.Generic Operates

Trojan-type malware, like HEUR.Malware.Babel.Generic, typically operates by disguising itself as a legitimate program or file. Once installed on a system, it can perform a variety of malicious actions, including data theft, installation of additional malware, or providing unauthorized access to the system. These actions can be initiated remotely by the creators of the malware, allowing them to exploit the infected system for various purposes. The exact mechanisms and goals of HEUR.Malware.Babel.Generic are not specified, but understanding the general behavior of Trojans helps in devising a removal strategy.

Symptoms of Infection

Systems infected with HEUR.Malware.Babel.Generic may exhibit a range of symptoms, including but not limited to, slow system performance, unexpected pop-ups, changes to browser settings, or the appearance of unfamiliar programs. In some cases, the infection may not display obvious symptoms, making regular system scans with reputable security software crucial for early detection. If you suspect that your system has been infected, it's essential to act quickly to minimize potential damage.

How to Remove HEUR.Malware.Babel.Generic

  1. Enter Safe Mode with Networking to prevent the malware from spreading or interfering with the removal process. This mode allows you to use the internet to download necessary tools while limiting the malware's ability to operate.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated to the latest version to maximize its effectiveness against the latest threats.
  3. Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only uninstall programs that you are certain are not essential to your system's operation.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings. This step helps remove any malicious extensions or settings changes made by the malware.
  5. After completing the above steps, reboot your system and perform another scan to ensure that the malware has been successfully removed. Repeated scans may be necessary to confirm the system is clean.

Conclusion

Removing HEUR.Malware.Babel.Generic from your system requires a combination of the right tools and careful action. By following the steps outlined above and maintaining vigilance through regular system scans and updates, you can protect your system and data from this and other malware threats. Remember, prevention is key, so always be cautious when downloading software or clicking on links from unknown sources.

Analysis Report

General information

Family Name: HEUR.Malware.Babel.Generic
Signature status: Self Signed

Known Samples

MD5: 9d15d1dd1eb4026147e596d2d2add828
SHA1: c42e447a7ab8b8433246944c883d9066b550697d
SHA256: E87D1C4BC47D418266CE86AFD606AE4B00C18E2685DCFD1C0EB16D6FD46A9C44
File Size: 755.32 KB, 755320 bytes
MD5: 5e764a9d36e2c0ecff19bd6bdb0674ae
SHA1: 6ac48fcf1839fbea8fd15ab770a2ae6bc48a60c8
SHA256: B132EC186C9586162D88BADADF5045233663B9A8619D6BAC806EE53BCB1A1A75
File Size: 206.34 KB, 206336 bytes
MD5: b0d4df290a1c1e14846c900f4777af06
SHA1: f274a3fcc6afd3fc11823ba1a3a119f4d55d2f43
SHA256: B6D23050A6B84588E8E66C1E7B8DD24F401EEFF5BF3FB03C4E9186AAB764542B
File Size: 857.72 KB, 857720 bytes
MD5: 0eeb22e7e098f65cccdd421a4563119b
SHA1: 392ec23237fabb36253cbb0481e6ad51d519d4ef
SHA256: 5055A10AF346F73597AC99B0DBC8865190405780D4A41D72BEF2D74858CCD3E4
File Size: 1.71 MB, 1710200 bytes
MD5: 02a067f11fcc1a5d9d876e77f95b5c2e
SHA1: 7ca30375522989679de44a4a2e91f2de1da101b8
SHA256: F416643BB2D4AC84555DECAE8AE3E6F4E34B26102CAC8CA297804CEF2A7200BD
File Size: 1.70 MB, 1700472 bytes
Show More
MD5: b0e77489bfea9b7ba333f0e928aca3c5
SHA1: 6c4b0f0b2e4cfc5a50417ca94867494189dfea5e
SHA256: E7BD38921FA708FF7BF269F2DC1C074DF777A99E9825247DD6EC87090C30BAB9
File Size: 857.72 KB, 857720 bytes
MD5: 9ea4c4b34dc8e74ccd95fb9777254ae9
SHA1: 47d224ef9e4dbb0439622aa46a1ede4da6c32e25
SHA256: 11B7B13AAA9F8CC973C96C579A6CE5752F88427CCAC06CE20F290FB1CA49097C
File Size: 857.72 KB, 857720 bytes
MD5: 33194fc6d8f73dd73874e37f1cdf383a
SHA1: 53c03668f75023398e31eb11988ebd2eeeb57561
SHA256: 0272215D11E7EA443E6BEBF33D08BF3CCAEDCF57EE3E2AF4CB9E264A832D651D
File Size: 282.74 KB, 282744 bytes
MD5: a3688637b5a2cab4d050a34925190c3b
SHA1: bd044ea1cb5738411e33be73a4b31017aae79188
SHA256: 05C73A3C165D7E12E2C0B1CB3883B5370271E2C77F90E04EE15E92B110CD3865
File Size: 2.17 MB, 2172778 bytes
MD5: 19accaf9313055de3d04905f9fd9eeef
SHA1: 163b34ee1ec5a445748ca845b8396742ff4df419
SHA256: 230DD4558A1E576582D3C552A21C2B5DEC6793EA99EB9AA36E33BC4ED872DBE9
File Size: 858.74 KB, 858744 bytes
MD5: 5704f5d6afef2049b39011ff154f60aa
SHA1: 9fc9c5911731f04a2ddbcb98adef0292bfd91d31
SHA256: 0B283E67F6EA1CE588C880DAA24CFFF6117852C4D89D5C7FE18636ACFA6BF674
File Size: 6.29 MB, 6293824 bytes
MD5: 7a6d51c13f9f00b01fe4bf41a67696d2
SHA1: 7598b992516ba2efd55bd8c3a7bcc51624de1f7c
SHA256: F921AF6824A35C6C2DAE998001024FB6877D94453C23CE5D521B954417346C56
File Size: 2.66 MB, 2663272 bytes
MD5: dd06410fa94bb410cb87caa2d27b589a
SHA1: 57650c58c18e2df7e7c4e5c296f9344b44feea87
SHA256: 9AA2CFC3A2E39EF3C14CBC4A21297059F7DF80D418540B86152FBDE15338E056
File Size: 3.77 MB, 3772416 bytes
MD5: fc5c7046009a8310fe4f3f0d9286549a
SHA1: b578260890e8a27f93285829e3d17aa5ad399b9e
SHA256: 63DC441D2DA1DBACD9A0862853C645833E0F38E6DFF12F26F376767DB076F1FE
File Size: 784.50 KB, 784504 bytes
MD5: ca3368ad4341e2f042380876ece677ee
SHA1: 6933e81392abd0178f5212cb662610ac7dc0fc56
SHA256: C1EF878CF7C73BE72C095688868FB52229066E06AD4817169318B3196436460E
File Size: 1.38 MB, 1379960 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is .NET application
  • File is 32-bit executable
  • File is 64-bit executable
Show More
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version
  • 19.1.25349.2
  • 7.2.50701.0
  • 4.0.2024.7021
  • 2.3.0.1
  • 2.2.8.0
  • 2.2.6.0
  • 2.2.3.2
  • 2.2.2.0
  • 2.2.1.0
  • 2.2.0.3
Show More
  • 2.2.0.0
  • 2.0.4.2
Comments
  • Cad library
  • License Wizard for .NET4
Company Name
  • Diagnostics
  • Gaea.Server
  • QuadSpinner
  • Royal Apps GmbH
  • Soraco Technologies Inc.
  • Valve Corporation
  • Wout Ware
File Description
  • CadLib
  • Diagnostics
  • Gaea.Engine
  • Gaea.Nodes
  • Gaea.Server
  • License Wizard
  • RoyalServer.ManagementEndpoint.Module.HyperV
  • Steam Client Service
File Version
  • 19.1.25349.2
  • 08.63.11.84
  • 7.2.50701
  • 4.0.2024.7021
  • 2.3.0.1
  • 2.2.8.0
  • 2.2.6.0
  • 2.2.3.2
  • 2.2.2.0
  • 2.2.1.0
Show More
  • 2.2.0.3
  • 2.2.0.0
  • 2.0.4.2
Internal Name
  • Diagnostics.dll
  • Gaea.Engine.dll
  • Gaea.Nodes.dll
  • Gaea.Server.dll
  • QlmLicenseWizard.exe
  • RoyalServer.ManagementEndpoint.Module.HyperV.dll
  • Steam Client Service (buildbot_steam-relclient-win32-builder_steam_rel_client_win32@steam-relclient-win32-builder)
  • WW.Cad.dll
Legal Copyright
  • (C) 2004-2024 Wout Ware
  • Copyright (C) 2016-2024
  • Copyright (C) 2016-2025
  • Copyright (C) 2016-2026
  • Copyright (C) Valve Corporation
  • Copyright © 2012-2025
  • Copyright © 2025, Royal Apps GmbH, Austria
Original Filename
  • Diagnostics.dll
  • Gaea.Engine.dll
  • Gaea.Nodes.dll
  • Gaea.Server.dll
  • QlmLicenseWizard.exe
  • RoyalServer.ManagementEndpoint.Module.HyperV.dll
  • SteamService.exe
  • WW.Cad.dll
Product Name
  • CadLib
  • Diagnostics
  • Gaea.Engine
  • Gaea.Nodes
  • Gaea.Server
  • Quick License Manager Wizard for .NET4
  • RoyalServer.ManagementEndpoint.Module.HyperV
  • Steam Client Service
Product Version
  • 19.1.25349.2
  • 7.03.50701.0-Branch.ts-publish-tc-v7.03.50701.0-t1036.Sha.a4f65b0d6a964462978e7c1e65eca5bb08c12540+a4f65b0d6a964462978e7c1e65eca5bb08c12540
  • 4.0.2024.7021
  • 2.3.0.1+7ce15a5c014e14bcb2f6ebca1de72bf08af32132
  • 2.2.8.0+676bbbf903a18c74c5cad5f52861f53cc1570926
  • 2.2.6.0+3297f72b2f6e83966dfa2dfba877992e9616678a
  • 2.2.3.2+5b3e0dfb42692837700402f79ab921c6803df370
  • 2.2.2.0+ffca12da22397babd9ebeedc52c59eaf1e5cc435
  • 2.2.1.0+d336b92d765ac39e80d6c8fa88eaf9861f1eeb35
  • 2.2.0.3+7ba0c35a3be755c0f3881c778f9ac73e248678ce
Show More
  • 2.2.0.0+50e62025c43112e8b5bd81d6c08596074ef6ee8f
  • 2.0.4.2+6e5a5654e76daca2c0fda1af54bf785f44a252cb
  • 01.00.00.01
Source Control I D 8631184

Digital Signatures

Signer Root Status
Valve Corp. DigiCert Trusted Root G4 Hash Mismatch
QuadSpinner SSL.com Code Signing Intermediate CA ECC R2 Self Signed
Soraco Technologies Inc. SSL.com Code Signing Intermediate CA ECC R2 Self Signed

File Traits

  • .NET
  • babel
  • big overlay
  • dll
  • HighEntropy
  • Installer Manifest
  • NewLateBinding
  • x64
  • x86

Block Information

Total Blocks: 2,698
Potentially Malicious Blocks: 29
Whitelisted Blocks: 1,057
Unknown Blocks: 1,612

Visual Map

? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? 0 ? 0 ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 x ? ? 0 ? ? ? ? 0 x ? ? 0 ? ? ? ? ? ? ? ? ? 0 x ? ? 0 ? ? ? ? 0 x ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? 0 ? ? ? ? ? ? ? 0 0 ? ? ? 0 ? ? 0 ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? 0 ? ? 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? 0 ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 ? ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 x ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 ? 0 x x ? 0 ? 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 0 ? ? ? 0 0 ? 0 ? 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 ? 0 0 ? ? 0 ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? x ? ? 0 ? ? ? x 0 ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? 0 0 0 ? ? 0 ? ? ? ? 0 0 ? ? ? ? 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? 0 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 0 0 ? 0 0 x x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? 0 0 ? 0 0 0 ? 0 0 x x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 ? 0 ? 0 ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? 0 ? 0 ? 0 ? ? ? ? ? ? ? ? 0 0 0 ? ? 0 ? ? ? ? ? ? 0 ? 0 ? 0 ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 0 0 0 ? ? 0 ? ? ? 0 0 0 0 0 x 0 0 ? ? ? ? x ? ? ? ? ? 0 0 ? ? 0 0 0 ? ? 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? 0 0 ? ? 0 0 ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? ? ? ? x ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? 0 0 ? ? 0 0 ? ? 0 ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? ? ? 0 0 ? 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 ? ? 0 0 ? 0 ? 0 ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? 0 ? 0 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 ? ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.Agent.HGF
  • MSIL.Downloader.Tiny.UA
  • MSIL.Dropper.SE
  • MSIL.Krypt.TDB
  • MSIL.Krypt.YACB
Show More
  • MSIL.Redline.RC
  • MSIL.Redline.RD

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �j&�5Bx#@�%f�1HO1�D9�9ߔ@V�A��R20`�2n�Ay�y�^{�=�P������7����������T��T��48�T�����T��m�Ù���p�'��IV�$�>�[��Κ��( G�5O�/��.;ߔ`�VtǤ��0����zH�Q]��@K� RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 �m!tX �� �v����(�*J*�"1�1HO@V�G�IH[u_�zb"hc�wk�ql(�q�X{b��P������������m��V����$�8წ���&M�=�S)�B1_T�Vw��`���%�������AE��"��D��&��$���LA*�" RegNtPreCreateKey

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateMutant
Show More
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • UNKNOWN
  • win32u.dll!NtGdiBitBlt
  • win32u.dll!NtGdiCreateBitmap
  • win32u.dll!NtGdiCreateCompatibleDC
  • win32u.dll!NtGdiCreateDIBitmapInternal
  • win32u.dll!NtGdiCreateSolidBrush
  • win32u.dll!NtGdiDeleteObjectApp
  • win32u.dll!NtGdiExtGetObjectW
  • win32u.dll!NtGdiGetDCforBitmap
  • win32u.dll!NtGdiGetDCObject
  • win32u.dll!NtGdiGetDeviceCaps
  • win32u.dll!NtGdiRestoreDC
  • win32u.dll!NtGdiSaveDC
  • win32u.dll!NtGdiSelectBitmap
  • win32u.dll!NtGdiSetDIBitsToDeviceInternal
  • win32u.dll!NtUserBuildHwndList
  • win32u.dll!NtUserCallTwoParam
  • win32u.dll!NtUserCreateEmptyCursorObject
  • win32u.dll!NtUserCreateWindowEx

30 additional items are not displayed above.

User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
  • CryptAcquireContext
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
Other Suspicious
  • AdjustTokenPrivileges

Related Posts

Trending

Most Viewed

Loading...