Adware.ConvertAd
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 8,531 |
| Threat Level: | 20 % (Normal) |
| Infected Computers: | 156,452 |
| First Seen: | February 17, 2014 |
| Last Seen: | February 4, 2026 |
| OS(es) Affected: | Windows |
Adware.ConvertAd is adware that may display unwanted pop-up ads on the PC when the computer user is visiting online shopping and social networking websites or any other websites. If the PC user clicks on the pop-up ads displayed by Adware.ConvertAd, it may forcibly reroute him to unreliable websites that may be commercial ones. Adware.ConvertAd may be added into the Web browsers such as Internet Explorer, Mozilla Firefox and Google Chrome while the PC user is installing free software from unprotected download websites. Once installed on the PC, Adware.ConvertAd may make modifications to the default browser settings and substitute the default start page and search engine or a new tab page with an unknown website. When the computer user attempts to look for anything on the Internet in any major search provider, Adware.ConvertAd may show the relevant toolbar on the Web browser that may deliver a variety of pop-up ads carrying sponsored links pertaining to the computer user's browsing routine.
Table of Contents
Aliases
10 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| AVG | Generic6.AZMY |
| Fortinet | Riskware/ConvertAd |
| McAfee-GW-Edition | Artemis!PUP |
| Avast | Win32:Adware-gen [Adw] |
| Symantec | Trojan.Gen.2 |
| McAfee | RDN/Generic PUP.x!cxr |
| McAfee | Artemis!818A1109EFF6 |
| McAfee-GW-Edition | Artemis |
| Panda | Trj/Genetic.gen |
| Kaspersky | UDS:DangerousObject.Multi.Generic |
SpyHunter Detects & Remove Adware.ConvertAd
File System Details
Adware.ConvertAd may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | kns90fdad7d-10c6-434d-b82a-ca5f94a01187.tmpfs | 9851dc8220696a7c5045dcef8d7b7117 | 130 |
| 2. | kns57.tmp | a28b9370844d23488be1edb68826e713 | 42 |
| 3. | prot7f8e1817-3fff-4e65-b89c-1052fd85f050.tmpfs | f10e3ddf2ee41bba95111a228aa3eef2 | 18 |
| 4. | kns894.tmp | 8d8a7111649c6af16b429fdbdfcbbab8 | 16 |
| 5. | kns7f8e1817-3fff-4e65-b89c-1052fd85f050.tmpfs | fa75ea63cb525f86aee39543eca18021 | 16 |
| 6. | knsA03.tmp | 85eaaab3b34954882ba76aa6dc99fe3f | 15 |
| 7. | knsn9C5A.tmpfs | 0cee03c69240ed2189f73b13ba3b6585 | 13 |
| 8. | knse7ec5858-562f-4371-8e83-58341b04fb5e.tmpfs | 16bda2ec7ecd31adad1e8ff884eeb71b | 13 |
| 9. | kns1c467019-f83d-4727-9eb5-9868f9755c8e.tmpfs | 9a01949eee6d6c2e91e548646bf2f491 | 12 |
| 10. | kns74498612-c276-4e56-807d-cd71d05b1f96.tmpfs | f947888209cfc229287df0f97af70fe0 | 11 |
| 11. | knsb666101b-38d6-4f29-9eaa-17a90ea9a872.tmpfs | 2d4400dde8187a7e5a79842e8df572e8 | 11 |
| 12. | knsc1B2.tmpfs | f99ebf278ebe0bd70583a6dcf8bbe04b | 10 |
| 13. | kns7a04456f-d56a-491d-8a04-59b66721829d.tmpfs | ad9dcb43ea49388fea23fef7f66bf3d4 | 10 |
| 14. | knsef68ade1-6975-45b5-9fba-08bb1a1a9fc5.tmpfs | 0d9a6ddefe57c2944fc836fd5380076c | 9 |
| 15. | kns44973763-5bc9-481a-9d90-baf3d0063b1e.tmpfs | 1d126324559192faf81a66c7e7ef4812 | 9 |
| 16. | prot0b39545c-bb10-4f60-9c79-494e87878e7a.tmpfs | 2e7cf795f223e7c91fc218856b7340ab | 9 |
| 17. | prot8999f45c-8c55-4138-8360-2f30ed82ebcc.tmpfs | b14fd4e363ca43608a448e79cae9571c | 9 |
| 18. | knsb0930e23-a479-48b3-afc7-92d17a5aabaa.tmpfs | 6c6b83f5885101fd2c6ea3fe3c504cf0 | 8 |
| 19. | kns42bb99cd-2435-4950-b740-4fcf0b60e655.tmpfs | 7892319978cde29a88b392510133576a | 8 |
| 20. | kns8bfd0e7f-ea9a-4b03-9a4e-84fcea8fa4dd.tmpfs | 2fed3a282ce968fbbf260ac5b7f219d7 | 8 |
| 21. | prot9f5a8939-f3c1-4a5f-a38e-92f54a8783e3.tmpfs | a188298e070b11a93cf7bbdc91bc1d28 | 8 |
| 22. | kns15bfe828-271a-475b-bb04-cf1fb22b6b3f.tmpfs | 09bb9765282cb61e2c55aa0b84dcd8e5 | 8 |
| 23. | knsa66ec34f-6bf6-4ddb-85fa-66b24a7b1978.tmpfs | cbd56a8711a331a9bdca7ea74437ddbf | 8 |
| 24. | IGSrv.exe | ef8ef39706d2997607ed7970fa6a7455 | 2 |
| 25. | file.exe | c7273a3f8ddbf11c5d6041f30edeba21 | 0 |
Registry Details
Adware.ConvertAd may create the following registry entry or registry entries:
Software\Microsoft\Windows\CurrentVersion\Run\SearchmeToolbarST
Software\SearchmeToolbarST
SYSTEM\ControlSet001\Services\ginoquci
SYSTEM\ControlSet002\Services\ginoquci
SYSTEM\CurrentControlSet\Services\ginoquci
CA Research
ConvertAd
PopupProduct
Directories
Adware.ConvertAd may create the following directory or directories:
| %APPDATA%\SearchmeToolbar |
| %LOCALAPPDATA%\CA Research |
| %LOCALAPPDATA%\ConvertAd |
| %LOCALAPPDATA%\igs |
| %PROGRAMFILES%\Programc |
| %USERPROFILE%\Local Settings\Application Data\ConvertAd |
| %USERPROFILE%\Local Settings\Application Data\igs |
| %WINDIR%\System32\config\systemprofile\AppData\Local\ConvertAd |
Analysis Report
General information
| Family Name: | Adware.ConvertAd |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
eeea3662d8aa2ce5daaef6c3e6a19a30
SHA1:
3131412c31a3b15be8bcb57e1883675e14ea5e50
File Size:
93.47 KB, 93472 bytes
|
|
MD5:
d350cd5d36b4871b8601e4e85663eeee
SHA1:
ca7bf28784e224203ceaae4f36b7039630e13c3c
File Size:
80.64 KB, 80641 bytes
|
|
MD5:
24503352fc4511c7a4a1b1d5352f323a
SHA1:
2d6171766a0dac2ca119229177c108606e5290f5
File Size:
86.90 KB, 86899 bytes
|
|
MD5:
64927067e659777b641fdfe150866656
SHA1:
f594a5bfa12bac8948a78f60de6eea576def16f9
File Size:
1.11 MB, 1114843 bytes
|
|
MD5:
5fe625d8f01c13457ec474f3b74bc038
SHA1:
be15bcb5dd1ed7b3d94b01c4bb6d2770ffd23549
File Size:
66.71 KB, 66712 bytes
|
Show More
|
MD5:
3d1e193b93fbce21b18d3b3f3ff42758
SHA1:
011b42548b6f491f3c0fbf3b272a284e39054e4c
File Size:
87.03 KB, 87032 bytes
|
|
MD5:
0b768a936dd9b1dd1d156c017f5192be
SHA1:
cb94058a6a0fff884288a38e6f6c69583f1b1618
SHA256:
410BD1F2803D6D5396E0959A25185A6F706FD794A67884D44B1F59462B32BCAB
File Size:
65.97 KB, 65965 bytes
|
|
MD5:
92d8d390c2277a7ab32de256f5ce4d22
SHA1:
c31cadeb03370b141d608d21d13e630f5af16b0b
SHA256:
6197939385B9036D5CF7E8228B84FC0C6FB17380000FD3945D7118BEB1929E4C
File Size:
344.81 KB, 344813 bytes
|
|
MD5:
571ff48ac12ee6e34db21a99d0a819ba
SHA1:
3caef3705c91898d866927263e9984ddbb87494a
SHA256:
719B67675B0EC1602CDE66AFA0FB81B3F3AA02694E132CAADD701207B1C7BB7A
File Size:
1.07 MB, 1073158 bytes
|
|
MD5:
3243d95cc89e1cfa63d06bb31f4f52f3
SHA1:
77f9a999ebca22248249f3b9052167fc450415ee
SHA256:
ADD5FC44179E62C27A8376E482D1144C3632699D87CEFAA8D04146B5453CA7E6
File Size:
339.42 KB, 339420 bytes
|
|
MD5:
5a043757da8a06bfd84c430d85a61161
SHA1:
afb2b9f278709e2e141273d87388372dc5a8f567
SHA256:
6E86C145A69399D3FB9EC359018DAC8A73330BAAE97A2139F0754B5F84BA9B5A
File Size:
65.28 KB, 65285 bytes
|
|
MD5:
0401728c4705fe29505244f6fd5493df
SHA1:
59bf4a24fdecca11c38d08123eb63fe085de9db1
SHA256:
2938FA7242028DE1273EAA0D5DE34DF012E27F5BBC5393040824525C6DC6E2DD
File Size:
87.16 KB, 87159 bytes
|
|
MD5:
bf3672408e474368c4762e043fd44e05
SHA1:
112558a769e473e15e0fa1ae7557234117e9a763
SHA256:
3E0ADA0F43C1633D220F6248D3C2257EC6906A0A6B99169EB153DCC959FC3A71
File Size:
861.81 KB, 861813 bytes
|
|
MD5:
cbdf2ba86ff0c2271571a3781b9009cd
SHA1:
32a39fac69ae46d5fd547ed46cde32639e5a712a
SHA256:
20B75D036CCAA04948DCD23BFA98E69EE9687D6B1E3FFA0AC851F2E78A7D2771
File Size:
318.32 KB, 318318 bytes
|
|
MD5:
26e26f5d291388c2ac96913fbfb6487a
SHA1:
64f533191c4843598712a1ba652ee9c92c0fd802
SHA256:
710C397B3DB8E1C1DBADAFABA65F2D8A328578D3FC579D7A45DC635BD32A0B1A
File Size:
92.26 KB, 92261 bytes
|
|
MD5:
d9b2561d40901be1e704d156a2bdccfa
SHA1:
2aac0577add46c4211d29fe5507c4ac4afada074
SHA256:
67F714218D51464D44CA18E6A593B823B4067697DEB04DB2D3DA985A36E75377
File Size:
64.64 KB, 64641 bytes
|
|
MD5:
0fc5ff284ab8347b2e4bcb8bbdd32e98
SHA1:
d5c5f175dc2308ae11ca717f33426149c9cfed91
SHA256:
2C0AC0AA6D014ECBA4628DA897B684BAE6A836CD1B7F2CA58768F04197F30893
File Size:
359.16 KB, 359160 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| File Description |
|
| File Version | 1.0.0.0 |
| Legal Copyright | (c) 2014 |
| Product Version | 1.0.0.0 |
File Traits
- Installer Manifest
- Installer Version
- nosig nsis
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- AdGazelle.A
- Downloader.Agent.TJ
- Mobogenie
- SearchSuite.C
- Zusy.CA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\nsa592e.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa5b39.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsa5b39.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa5b39.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsb5d83.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsc2e44.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd3e9d.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsdd2af.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsec5e8.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsec5e8.tmp\inetc.dll | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\nsec5e8.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsed39b.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf445d.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsff5f7.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsi4bb2.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsi4bb2.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsi4bb2.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsj330a.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsk5843.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsl5b90.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsl5bed.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsl61f1.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsla479.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nslbd99.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsn2e84.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsn2e84.tmp\wmiinspector.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsnbf61.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nso3192.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nso55e2.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsp64b8.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsp6507.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2463.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsq2463.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq2463.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsq5b60.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsq6135.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsrbea3.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nss6790.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nss6790.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nss6790.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nstc337.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu4382.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsuc5a9.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv2442.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv595e.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsv595e.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsv595e.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsv5b19.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsvf6f2.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx4b72.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx6770.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyc357.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsyc357.tmp\inetc.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsyc357.tmp\inetc.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsz5759.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\~nsu.tmp\au_.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\downloads | Synchronize,Write Attributes |
| c:\users\user\downloads\2aac0577add46c4211d29fe5507c4ac4afada074_0000064641 | Synchronize,Write Attributes |
| c:\users\user\downloads\2d6171766a0dac2ca119229177c108606e5290f5_0000086899.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\59bf4a24fdecca11c38d08123eb63fe085de9db1_0000087159 | Synchronize,Write Attributes |
| c:\users\user\downloads\64f533191c4843598712a1ba652ee9c92c0fd802_0000092261 | Synchronize,Write Attributes |
| c:\users\user\downloads\afb2b9f278709e2e141273d87388372dc5a8f567_0000065285 | Synchronize,Write Attributes |
| c:\users\user\downloads\be15bcb5dd1ed7b3d94b01c4bb6d2770ffd23549_0000066712.exe | Synchronize,Write Attributes |
| c:\users\user\downloads\cb94058a6a0fff884288a38e6f6c69583f1b1618_0000065965 | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Suzbnvfy\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Suzbnvfy\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Suzbnvfy\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Vzqhvwcc\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Vzqhvwcc\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Vzqhvwcc\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp \??\C:\Users\Mfnkr | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp \??\C:\Users\Emtdf | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Yfcipuan\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Yfcipuan\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Yfcipuan\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp \??\C:\Users\Naagr | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\77e37ce0-8214-4414-aced-551c5ae204d7.tmp \??\C:\Windows\SystemTemp\e28eadcf-6ab0-4d8c-8821-7ce9a6aba1 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9 \??\C:\Windows\SystemTemp\b1a39cca-eadf-4949-a384-a0ef6a3b3fd2.tmp \ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings::proxyenable | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\nlasvc\parameters\internet\manualproxies:: | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| Network Wininet |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Suzbnvfy\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Vzqhvwcc\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Mfnkrwlp\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
c:\users\user\downloads\VOsrv.exe remove
|
"C:\Users\Emtdfqct\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
Show More
"C:\Users\Yfcipuan\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Naagrnco\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Iztngbop\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Cpfdojws\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
proxy_remove_cmd_xp
|
proxy_remove_cmd_win7
|
"C:\Users\Ylrizhkn\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Vicgqnrq\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
