Multi-License Discount Quote

Change Region

English
Threat Database Trojans Trojan.MSIL.Krypt.GBEA

Trojan.MSIL.Krypt.GBEA

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 18,279
Threat Level: 80 % (High)
Infected Computers: 1,185
First Seen: June 4, 2021
Last Seen: May 6, 2026
OS(es) Affected: Windows

The detection of Trojan.MSIL.Krypt.GBEA on your system indicates a potential security threat that requires immediate attention. This Trojan-type threat can compromise your system's integrity and put your personal data at risk. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.

What Is Trojan.MSIL.Krypt.GBEA?

Trojan.MSIL.Krypt.GBEA is a type of malware that can infect your system and allow unauthorized access to your computer. The name suggests that it is a Trojan-type threat, which means it can disguise itself as a legitimate program or file to gain entry into your system. Once inside, it can cause a range of problems, including data theft, system crashes, and unauthorized changes to your system settings.

How Trojan.MSIL.Krypt.GBEA Operates

Trojan.MSIL.Krypt.GBEA can operate in various ways, depending on its design and purpose. It may spread through infected email attachments, suspicious downloads, or exploited vulnerabilities in your system. Once it infects your system, it can create backdoors, allowing hackers to access your computer remotely and steal sensitive information, such as login credentials, financial data, or personal files. It may also install additional malware, modify system settings, or disrupt your system's performance.

Symptoms of Infection

The symptoms of a Trojan.MSIL.Krypt.GBEA infection can vary, but common signs include slow system performance, unexpected crashes, and unfamiliar programs or icons on your desktop. You may also notice unusual network activity, such as unexpected data transfers or strange login attempts. In some cases, you may receive alerts from your security software or notice that your system settings have been changed without your consent.

  • Unexplained system crashes or freezes
  • Slow system performance or sluggish response times
  • Unfamiliar programs or icons on your desktop
  • Unexpected network activity or data transfers
  • Changes to system settings or security software alerts

How to Remove Trojan.MSIL.Krypt.GBEA

  1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow your security software to run more effectively.
  2. Run a full scan with a reputable anti-malware tool, such as SpyHunter, to detect and remove the Trojan.MSIL.Krypt.GBEA and any related malware.
  3. Uninstall any suspicious programs or applications that may be related to the infection.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
  5. Reboot your system and run another full scan to ensure that the malware has been completely removed.

Conclusion

Removing Trojan.MSIL.Krypt.GBEA from your system requires careful attention to detail and a thorough approach. By following the steps outlined above, you can help ensure that your system is clean and secure. Remember to always be cautious when downloading software or opening email attachments, and keep your security software up to date to prevent future infections. If you are unsure about any aspect of the removal process, consider seeking guidance from a qualified IT professional or security expert.

Analysis Report

General information

Family Name: Trojan.MSIL.Krypt.GBEA
Signature status: No Signature

Known Samples

MD5: d1720c71a925ee57bc5e393755ff1fc2
SHA1: 96ae58e5a9ec238d003f66ea1368243f5d9e4890
SHA256: BC081F24C74CA3AA30EF4BB4824326D16A5D66307F08DEA3771BDE51F179B14E
File Size: 943.12 KB, 943120 bytes
MD5: 79dde3acc77da54310492bbb49ac9391
SHA1: 68e4e5946aa4657196de72d70d96e4516c560db0
SHA256: 17FD0C860342931DDBA13BAA1F17F66ECDC44811602E4ED5AF0D9D2945808C80
File Size: 3.68 MB, 3675136 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
Show More
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version 2.4.0.0
Comments Excel汇总大师-www.ffcell.com
Company Name 方方格子·工作室
File Description
  • description
  • Excel汇总大师
File Version
  • 7.0.0.0
  • 2.4.0.0
Internal Name Summary.exe
Legal Copyright Copyright © 2026
Original Filename Summary.exe
Product Name Summary
Product Version 2.4.0.0

File Traits

  • .NET
  • .sdata
  • HighEntropy
  • NewLateBinding
  • Reactor
  • RijndaelManaged
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 6,055
Potentially Malicious Blocks: 182
Whitelisted Blocks: 4,450
Unknown Blocks: 1,423

Visual Map

x x x 0 0 0 0 0 0 0 ? 0 0 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x ? 0 ? ? 0 0 ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 0 ? 0 ? ? x ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? x ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 ? 0 0 0 0 ? 0 ? ? 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? ? ? ? ? 0 0 0 0 ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? 0 ? ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? x ? 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? 0 0 ? ? x ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? x x x ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? x x x ? ? ? ? ? ? ? 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? ? ? ? 0 0 ? ? ? ? x x x ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 x ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? 0 0 0 0 ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? ? x x ? ? x x ? ? ? ? ? ? ? ? ? 0 0 0 ? 0 ? 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? 0 ? 0 0 ? ? 0 0 ? 0 ? ? ? 0 ? ? ? x 0 ? ? ? ? 0 ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? 0 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? x ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 0 ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? 0 0 ? ? ? 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
\device\namedpipe\gmdasllogger Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsma00a.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsma00b.tmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsma00b.tmp\system.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsma00b.tmp\system.dll Synchronize,Write Attributes
c:\users\user\appdata\roaming\1337\29.01.18.exe Generic Write,Read Attributes
c:\users\user\appdata\roaming\1337\alinperviy.exe Generic Write,Read Attributes
c:\windows\appcompat\programs\amcache.hve Read Data,Read Control,Write Data
c:\windows\appcompat\programs\amcache.hve Write Attributes

Registry Modifications

Key::Value Data API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Ol6�8 �vT������5!wz#�(�(X�1`1�1HO1�D9ߔ@V�H[uK��R20`�2g�Xi��j�bk`k�ql(�lR o�rnJu�~w�n{�=�P��/�����b:����X����T���.�a �T��T��m�Ù����$�8����j���(��oB1_����zH�Q RegNtPreCreateKey
Show More
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Pl7�8 �vT������5!wz#�(�(X�1`1�1HO1�D9ߔ@V�H[uK��R20`�2g�Xi��j�bk`k�ql(�lR o�rnJu�~w�n{�=�P��/�����b:����X����T���.���a �T��T��m�Ù����$�8����j���(��oB1_����z RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Ql<�8 �vT������5!wz#�(�(X�1`1�1HO1�D9ߔ@V�H[uK��R20`�2g�Xi��j�bk`k�ql(�lR o�rnJu�~w�n{�=�P��/������7�M�b:����X����T���.���a �T��T��m�Ù��IV���$�8����j��(!��(��o RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 限ȁਪˣ鈯ˣ遙̃豤̃অˣ炑̃濖̃賬̃獖} 偫~ 엦1਷ˣ邯̃뫯ʃeꙥžЂ엦1 ¶fꙥžiOꙥžr;֢sꙥžvꙥž RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 Sl@�8 �vT������5!wz#�&� &�-(�(X�1`1�1HO1�D9ߔ@V�H[uK��R20`�2g�Xi��j�bk`k�ql(�lR o�rnJtǤu�~w�n{�=�P��/������7�M�b:����X����T���.���a �T��T��m�Ù��IV���$�8���Κ��j RegNtPreCreateKey
HKLM\system\software\microsoft\tip\aggregateresults::data �ӹ��J�~+z��,��+z��Tg _7��mw��4 ��|�$U�4 ��|��Q�\��lkn Ϛ���� Ϛ����Ϛ����Ϛ���� RegNtPreCreateKey

Windows API Usage

Category API
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection
  • ReadProcessMemory
  • ZwMapViewOfSection
Process Shell Execute
  • CreateProcess
  • ShellExecute
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAdjustPrivilegesToken
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
Show More
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDelayExecution
  • ntdll.dll!NtDeleteValueKey
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtFsControlFile
  • ntdll.dll!NtLoadKeyEx
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenSymbolicLinkObject
  • ntdll.dll!NtOpenThread
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySymbolicLinkObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtTraceEvent
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Encryption Used
  • BCryptOpenAlgorithmProvider

Shell Command Execution

open C:\Users\Tvqgapnd\AppData\Roaming\1337\29.01.18.exe
open C:\Users\Tvqgapnd\AppData\Roaming\1337\alinperviy.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 772

Related Posts

Trending

Most Viewed

Loading...