Trojan.Kryptik.KBP
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,489 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 15,622 |
| First Seen: | July 6, 2021 |
| Last Seen: | August 2, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Kryptik.KBP on your system indicates a potential security threat that requires immediate attention. This Trojan-type threat can compromise the integrity of your computer and put your personal data at risk. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.
Table of Contents
What Is Trojan.Kryptik.KBP?
Trojan.Kryptik.KBP is a type of malware that can infiltrate your system without your knowledge or consent. Trojans are malicious programs that disguise themselves as legitimate software, allowing them to evade detection and gain unauthorized access to your computer. Once inside, they can cause significant damage, including data theft, system compromise, and disruption of normal computer functioning.
How Trojan.Kryptik.KBP Operates
Trojan.Kryptik.KBP, like other Trojans, operates by exploiting vulnerabilities in your system or deceiving you into installing it. It can spread through various means, such as infected email attachments, compromised websites, or infected software downloads. Once installed, it can communicate with its command and control servers to receive instructions, which may include stealing sensitive information, installing additional malware, or using your computer for malicious activities.
Symptoms of Infection
Identifying a Trojan infection can be challenging, as these malware types are designed to remain stealthy. However, some common symptoms may indicate the presence of Trojan.Kryptik.KBP or similar malware. These include unexpected changes in system behavior, slow performance, unfamiliar programs or icons, and unexpected network activity. If you notice any of these symptoms, it is crucial to take immediate action to scan your system and remove any detected threats.
How to Remove Trojan.Kryptik.KBP
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for a clean environment to perform removal steps.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This will help identify and remove Trojan.Kryptik.KBP and any other malware that may be present.
- Uninstall any suspicious programs or applications that you do not recognize or that were installed around the time the malware was detected.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings that the Trojan may have altered.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all components of the malware have been removed.
Conclusion
Removing Trojan.Kryptik.KBP requires careful and immediate action to prevent further damage to your system and protect your personal data. By following the steps outlined above and maintaining good computer hygiene practices, such as regularly updating your operating system and security software, using strong passwords, and being cautious with emails and downloads, you can significantly reduce the risk of future infections. Remember, vigilance and proactive measures are key to safeguarding your digital security in today's evolving threat landscape.
Analysis Report
General information
| Family Name: | Trojan.Kryptik.KBP |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
f968a7ad25b6603c5c95612e6dab6519
SHA1:
0d71a9169bc81454a342023c35af666f7ec25951
File Size:
2.51 MB, 2513175 bytes
|
|
MD5:
67b2d180d63eb848565154a200bae707
SHA1:
8221c1b4851557307c78a60a65fbaa065a552b29
File Size:
1.02 MB, 1018631 bytes
|
|
MD5:
f3d7cf49bd2ed49e59e34ad5051888ad
SHA1:
6069c4e5ec5ad852938059d6078ee053ed007402
SHA256:
573726DBF53B9CB454923112C7F974BDA6FBB2B200CECCADACA64A8A173D35A2
File Size:
823.53 KB, 823535 bytes
|
|
MD5:
dab07fab9d93150d5b053c56c7b15b34
SHA1:
1383b1c58f57a19c0487c816a391f6e2c95eb291
SHA256:
C9F27CE2E972F465E2A0EE0E05E9603CB5CE7B53254DBD798398ABDB0FF89BA5
File Size:
2.73 MB, 2725941 bytes
|
|
MD5:
e07bc792de1a6264db8677b00f84c073
SHA1:
a354a54bcb35f2f81a81241b4344c34db4393411
SHA256:
14E0EC3319FA780279830761CB70D1E06287032BDCAB233EA88685D449C954FC
File Size:
225.83 KB, 225829 bytes
|
Show More
|
MD5:
1ebb4d7c67a7894b32632303b5b2340f
SHA1:
ff57732e8227e65ca8c78afcf743dc42497b248c
SHA256:
AF15C6178091309E1B983FFD5241160D6550B7028336F40796488EE16E56CD4A
File Size:
1.11 MB, 1108518 bytes
|
|
MD5:
5a1409663765fa0f9f193cad16a6f502
SHA1:
a766fd3c30c6726d417fb203f66f39226f7959bd
SHA256:
8C149BD98797416B13EA79A40ED9E0AAB3159D7AEC32ACB09BF2BFFF2862D932
File Size:
3.10 MB, 3098823 bytes
|
|
MD5:
207af92929a90eee9523f1fb48e95cd0
SHA1:
f61315508f2f6eb94c9a5af54ce26ed10c65b056
SHA256:
77F5562A7E5FC440299C2A406731D85133FBEEBDDF07F2231C5408F8A9EF3155
File Size:
1.51 MB, 1508070 bytes
|
|
MD5:
4a1e1278ad91b4c5e130eed18e82e18d
SHA1:
da8dbf9f96cd1b39f66d4de0232f570227aba8e6
SHA256:
D201AE2DF0553902B2DA9E848DA435C74D9A269092E49EA927DB996E96F3EB4F
File Size:
1.21 MB, 1214787 bytes
|
|
MD5:
bced06fbb566c6669a755fcef6b9c1c7
SHA1:
3bef0fcb143ff9a552d4f8199158d4c6bb13230b
SHA256:
A116BF3E7165647ED39F7F3AACA49C30EB4F2DAB331DF87C300FCAC3347BB63A
File Size:
1.48 MB, 1484628 bytes
|
|
MD5:
93868ac6a2facd746067095d6ec0f7bb
SHA1:
d4611cad25020d123f37df0182097b5bc220a925
SHA256:
771682F878C2A71955635A52E25FE1548393C68031D9F19DC6A371CF50A7FC59
File Size:
608.13 KB, 608128 bytes
|
|
MD5:
62164737f2c16da7480e50cfcf5fdb66
SHA1:
964104bb8682a1fe23eac8e9c8b9f0b1b6b0d50d
SHA256:
35DCDC6B09DFEB4BBE2B607FA2E60A130A8D64049AB6721B37380FB8E9C1646F
File Size:
620.50 KB, 620495 bytes
|
|
MD5:
d948723f24f7ef671c7f23e7c04e3df6
SHA1:
983731adc41c57b770a740e917b3c69baa5a0d04
SHA256:
4E7472D966B01D8891919D6B02C8720B91B50C322C1FF22B0FEEBEED63F9FC60
File Size:
677.25 KB, 677250 bytes
|
|
MD5:
3dc1bd6adfbdb93fdbdd62773a78fe55
SHA1:
dfdada15e0e33f09c8e645d53122ce7e7b056d47
SHA256:
C5C43306F0F47F12F6B5552944528F3AEEDCF99F998ABC6576D54C231593BAD3
File Size:
407.43 KB, 407432 bytes
|
|
MD5:
9a8421c1531ff81ee1fbc645cc517119
SHA1:
30ab65b196cadbfe4d5294f7bacb492bf79beb37
SHA256:
7648F207C055164F4D4ED1D12D5A525695DDFFDC09FB816B8C01996A2920D3E4
File Size:
897.21 KB, 897208 bytes
|
|
MD5:
1e6dbcf137acaeccbf7b39db842f489f
SHA1:
ab24f8c3e40fe708529ce97efa0fae4db2ec9311
SHA256:
DD66CC381F6899411E7BD73449744B55C3BC3D40F432FDE85E0AD2F3FA10DC51
File Size:
2.70 MB, 2699964 bytes
|
|
MD5:
b9a77216900c859465f20c44644c500a
SHA1:
083f03fd9a127fb5edf005e9935a4f221c7e3a3c
SHA256:
3894F2173BA17AF0FBF027DF0AE9701E0070A20F5C3E5C93B33D76E75F5AB85F
File Size:
3.15 MB, 3154874 bytes
|
|
MD5:
5e2911f466fecdbceb8fb6da0ffe5597
SHA1:
f2b6aded761220de868c7aefcd9f74b90b9c62ae
SHA256:
41E57FF7999C286586EAB5716BF716E559BA5904DAC57134DD21AD00813A4AC9
File Size:
2.16 MB, 2161336 bytes
|
|
MD5:
6afd883962d7de1234440d856e652b84
SHA1:
28737677e3c6ec5268f43452168d0a1c74a9b17e
SHA256:
6C88019E9502E5964CA0167F8E0A5D3A4857F2D2C85ABB594907A337BF6A04D5
File Size:
675.01 KB, 675011 bytes
|
|
MD5:
1269fb8c81c3b0b68313e4df70286761
SHA1:
f59701a15314246b435a0a11fa75829689f8b294
SHA256:
E1A22D7BC0561A95155B125913F0007395562C9B12E628F7622E4B01A3BD4831
File Size:
2.40 MB, 2397926 bytes
|
|
MD5:
5c0404ac5f5d3eda01874f310827da0d
SHA1:
d11bd26ffd0121e9e91115104936f33b8b51e83c
SHA256:
4256DA6D13DF4568E63216D43D68ADEE714ACE498B97EE205915C87FEF20B966
File Size:
199.23 KB, 199228 bytes
|
|
MD5:
7d2a8864ae5aee99bebcff06ecdb2649
SHA1:
24c3ad0ca5b516728adf54a2c98bfe7f839d2669
SHA256:
166E28FD54DC0D8EEEDB8533A0B556641102AB5D667656410C059F684387CE5E
File Size:
1.91 MB, 1914208 bytes
|
|
MD5:
af9878842b18acec485852877ed39cd8
SHA1:
7c645cc0c5656b30f1e91824518c28eed358f9f8
SHA256:
23ACCA97A1B53A471F15E55F2363DF17BF2C904EAD85E94E7AAE1157AD6FE0AD
File Size:
791.65 KB, 791654 bytes
|
|
MD5:
498bfdddb1590f57355838ebe0ee1fb3
SHA1:
84741480d395a5c6bfc108c58a1de9777f743c49
SHA256:
28D71A3F68F2F169415AFDA987A910268DDD3EF0DDDB7CBF9E29C0644A320B93
File Size:
1.04 MB, 1041894 bytes
|
|
MD5:
1b8c146280d0874aa28df2f41c8505df
SHA1:
91796394f3367236e1edec47bf1ca6cff33da5d0
SHA256:
8CE648DC00040EDECD0AA77B550E829C9C4FE25A623B682F9950BE0F09DA1B8C
File Size:
897.40 KB, 897403 bytes
|
|
MD5:
c68efa765fdabad78c79d5f02c7822ec
SHA1:
44f89d1590fd89908264d7deeb70027d6efb3b5e
SHA256:
1CC4DA206025FD386901FC076BACD66C01BC5953FE70F34C34928110C913FF31
File Size:
2.92 MB, 2915010 bytes
|
|
MD5:
9bef06ba19fac88edaaadbcdfff8c81b
SHA1:
d4694fb44618b21fbdc650fe628f1a3f5961c8ae
SHA256:
2E52B8861BFEE15AE7369F4B9FFC9CC4DA13EFB7182BEBC605D104DB733DA8C6
File Size:
212.73 KB, 212728 bytes
|
|
MD5:
3fdddadcb8737c1f7e048ee0eaf30b82
SHA1:
1c566caf6ef2a50473956a7533f3f83b0bb962d7
SHA256:
6C42394D4A0CB64359F43525A5CC496C8CB42AEAC242B699711F05E3E5E46371
File Size:
1.47 MB, 1474482 bytes
|
|
MD5:
65900bfe8e49254df60ff93ac97543db
SHA1:
6024c8ab2e2f10e050ef7fb65fb737eee0565fd3
SHA256:
027BB19B9B459413BD86DDCF35F77307DC6DEDAC07DE974AD4CD1E3B95900C02
File Size:
186.54 KB, 186540 bytes
|
|
MD5:
2eb86167bf84cc0517e4e5729821f0e2
SHA1:
a3c526fa68a67b122fc61e826627bad22b9e9cd9
SHA256:
650469E397E06A293EB8E5A66A9F4F817285D476FD730F709792425A09393190
File Size:
1.54 MB, 1537371 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
3 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
Show More
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- big overlay
- HighEntropy
- Installer Manifest
- Installer Version
- SIM
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 782 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 782 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Kryptik.KBBJ
- Kryptik.KBD
- Kryptik.KBH
- Kryptik.KBP
- Lamer.CA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\pshost.134121602027619089.8092.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| c:\program files (x86)\esoft\mycam\acutil.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\acutil.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\acutil.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\avlf.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\avlf.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\avlf.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\gdiplus.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\gdiplus.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\gdiplus.dll | Synchronize,Write Attributes |
Show More
| c:\program files (x86)\esoft\mycam\hand.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\hand.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\hand.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\liveupdate.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\liveupdate.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\liveupdate.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\microsoft.vc90.crt.manifest | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\microsoft.vc90.crt.manifest | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\microsoft.vc90.crt.manifest | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcp90.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcp90.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcp90.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcr90.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcr90.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\microsoft.vc90.crt\msvcr90.dll | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\mycam.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\mycam.exe | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\mycam.exe | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\snapshot.wav | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\snapshot.wav | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\snapshot.wav | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\uninstall.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\uninstall.exe | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\uninstall.exe | Synchronize,Write Attributes |
| c:\program files (x86)\esoft\mycam\zlib.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\esoft\mycam\zlib.dll | Generic Write,Read Attributes |
| c:\program files (x86)\esoft\mycam\zlib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\15.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\15.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\15.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\16.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\16.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\16.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\2.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\4.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\4.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\4.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\5.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\5.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\5.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\7.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\7.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\7.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\8.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\8.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\8.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\9.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\$inst\9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\$inst\9.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\$inst\temp_0.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_ezbtjnqg.24w.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_o1at1rai.d5b.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd29e6.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd29e6.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi28cc.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsif4b4.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsma69d.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsma69d.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsn3cad.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsn3cae.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsn3cae.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nso29d6.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nswa506.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nswa68c.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsx3bb3.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\advsplash.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\aero.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyf5fd.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\spltmp.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\spltmp.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\aboutlogo.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\aboutlogo.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\aboutlogo.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskoff.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskoff.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskoff.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskon.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskon.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\diskon.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragcopy.cur | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragcopy.cur | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragcopy.cur | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragmove.cur | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragmove.cur | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragmove.cur | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragno.cur | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragno.cur | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\dragno.cur | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\estimate.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\estimate.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\estimate.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\file.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\file.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\file.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\folderup.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\folderup.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\folderup.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordoff.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordoff.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordoff.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordon.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordon.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\passwordon.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rar.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rar.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rar.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rarsmall.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rarsmall.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rarsmall.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rev.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rev.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\rev.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\setup.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\setup.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\setup.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfx.ico | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfx.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfx.ico | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfxlogo.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfxlogo.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sfxlogo.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortdown.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortdown.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortdown.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortup.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortup.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\sortup.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\add.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\add.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\add.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\benchmark.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\benchmark.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\benchmark.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\comment.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\comment.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\comment.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\convert.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\convert.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\convert.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\delete.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\delete.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\delete.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\exit.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\exit.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\exit.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extract.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extract.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extract.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extractto.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extractto.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\extractto.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\find.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\find.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\find.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\info.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\info.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\info.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\lock.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\lock.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\lock.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\print.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\print.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\print.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\protect.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\protect.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\protect.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\repair.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\repair.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\repair.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\report.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\report.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\report.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\sfx.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\sfx.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\sfx.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\test.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\test.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\test.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\view.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\view.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\view.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\virusscan.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\virusscan.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\virusscan.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\winrar\themes\winrar windows 10 by seven7i\toolbar\wizard.bmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
11 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Firbgszh\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Firbgszh\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Firbgszh\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Htwpzixd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Htwpzixd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Htwpzixd\AppData\Local\Temp\~nsuA.tmp | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::displayname | Seven7i 1.00 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::displayversion | 1.00 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::versionmajor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::versionminor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::publisher | Seven7i | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::displayicon | C:\Users\Rwaeyfsy\appdata\Roaming\WinRAR\Themes\Winrar windows 10 By Seven7i\Uninstall.exe | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::uninstallstring | C:\Users\Rwaeyfsy\appdata\Roaming\WinRAR\Themes\Winrar windows 10 By Seven7i\Uninstall.exe | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::urlinfoabout | http://www.company.com/ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::helplink | mailto:support@company.com | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::installlocation | C:\Users\Rwaeyfsy\appdata\Roaming\WinRAR\Themes\Winrar windows 10 By Seven7i\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::installsource | c:\users\user\downloads\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::installdate | % | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::language | Љ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::estimatedsize | Ѻ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::nomodify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\seven7i 1.00::norepair | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鏅绢ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKCU\local settings\muicache\1b\52c64b7e::@c:\windows\system32\ndfapi.dll,-40001 | Windows Network Diagnostics | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::displayname | MyCam 1.1 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::displayversion | 1.1 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::versionmajor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::versionminor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::publisher | Esoft | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::displayicon | C:\Program Files (x86)\Esoft\MyCam\Uninstall.exe | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::uninstallstring | C:\Program Files (x86)\Esoft\MyCam\Uninstall.exe | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::installlocation | C:\Program Files (x86)\Esoft\MyCam\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::installsource | c:\users\user\downloads\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::installdate | &( | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::language | Ж | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::estimatedsize | ᇹ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::nomodify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\mycam 1.1::norepair | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::displayname | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::displayversion | 1.0.0.2 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::versionmajor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::versionminor | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::publisher | - | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::displayicon | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::uninstallstring | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::installlocation | \ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::installsource | c:\users\user\downloads\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::installdate | &0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::language | ε | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::estimatedsize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::nomodify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall::norepair | RegNtPreCreateKey | |
| HKCU\software\microsoft\ctf\msutb::left | Դ | RegNtPreCreateKey |
| HKCU\software\microsoft\ctf\msutb::top | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Anti Debug |
|
| User Data Access |
|
| Process Shell Execute |
|
| Keyboard Access |
|
| Process Manipulation Evasion |
|
| Syscall Use |
Show More
|
| Encryption Used |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Firbgszh\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
"C:\Users\Htwpzixd\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
open powershell.exe -Command "Add-MpPreference -ExclusionPath '$env:APPDATA\windowshost'"
|
"C:\Users\Wqzqbbyu\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
