Backdoor.MSIL.ClipBanker.ACJ
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 5,751 |
| Threat Level: | 60 % (Medium) |
| Infected Computers: | 4,836 |
| First Seen: | May 14, 2023 |
| Last Seen: | April 23, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Backdoor.MSIL.ClipBanker.ACJ |
|---|---|
| Signature status: | Modified signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
5bb0dba98dcb251858310442a94d4ba0
SHA1:
5c3c523763caa463e25580b1e42482d9e0fb50b4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
7b9ea426e545dea39edce1197926657b
SHA1:
8cc69fca028ee95910ff581dfa7ad5808605a150
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ac6e68023216b8e4b8afb2db4d74db60
SHA1:
15a94a58bf5fd64cdde92962497ea4535f3ba67c
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
801b0a6baf45e5a01904232705d9bc6b
SHA1:
f9b14193d370876aec0327ee2f37652bd33490ac
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e9544eedcf7d02ff52e61594b18f8ae3
SHA1:
f7ca9d2af50bbe9a2d378a7d19f366d1c4902760
File Size:
4.14 MB, 4143368 bytes
|
Show More
|
MD5:
db4387182ec6d5bac2488feb9117d713
SHA1:
ca553953a2dc1b042f1c47aba4da58665de357fa
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
6e9defcfd3e8991996b1754403471bcb
SHA1:
2d6e7381d0ad5aea79569e942e238be9f7cc5bda
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
9893745481d98e459e916aa1fbc5ed55
SHA1:
5ff64cdf4ce9d56fd1f4935085382b460621e375
SHA256:
D48B202CA1A6A28F30BECABDEFA6F3AA4DEF519175DBB829130E19DD58656759
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
cbd0bbf969b3a3239ada11356bcf683a
SHA1:
6617292badfadfd7be718e0f3404c4b534e476b1
SHA256:
5EAFADB848C945A1DE60766A292A13F133E164FD130E0CA7FE76971AE855234E
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
38cc50adf1afa9f35b43fca916878ee4
SHA1:
63c52208f7b8794fef44ede7558890da8d9e48d5
SHA256:
CD83FDD70FAA5D5FFFABEDE5F9250FFB3A01AE78318431AB6323D46B2B6ACE58
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
2524b5d705b170dcf316a05096182ab8
SHA1:
d6b7b0b24008f1162e6b225c86612192d2f61a6f
SHA256:
B4422C59D99EAC1833A86AED0D499AC2418D1CFA800A5DE6BC815A73CEC9CB8F
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ef634909e67c747f61df12eb9867232a
SHA1:
e574bf2d2b4a532071dad715efac5a0f72c06ff5
SHA256:
7C18C48375B2360F9C89EE40494414CD63D933BDAEAA1E5272E06FB329C5D5C8
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c1c9161711df6655775d92d2926b857a
SHA1:
56f640e9cddbda954a2df78b1eaa79aa18ced853
SHA256:
E9D050C1B04294185B4624C5B33798B922AB90F254AA086E06A6F85E3251D906
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
efe1783cb1e7302ba802363be558e180
SHA1:
ebbe33e1611385bc509350830e221e4fabd90da1
SHA256:
8A1B199473D09C8EF2AB5249CA56C043C2FE0FE39B46148A065AA816C345813D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
004a0deb6985f4b363c43b43b36e96a0
SHA1:
0af1cd5a09365d2c4815e469271c6b6da3db5827
SHA256:
657C51C84F9AC8CA7F9C0F0645DEA21155FCCB1CFBB13E6AACF3A1DC8300D9E5
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
1b793de152ee50988715d7c35a7ba7c2
SHA1:
356bb2767e6eed6a1ad7c7dbd919679db536f854
SHA256:
1A0FA4B9CB9715670615D88CADC7F3505C847A88CF9EB4FF3D9B1B4A5D45AE53
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c02e0ae69096b0147e802c0bb990eec8
SHA1:
bf8945b16d5ea73c06972de40da1735dea2c087f
SHA256:
5D0542438850BD54C3DCF27C6157B3EFD46C869C674597527633DEB9A75CB1E9
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
9ee9db316aa58af5cf197fb4ba606c89
SHA1:
254cb8ae972ba9c550f5479e1e2697278a1bb349
SHA256:
9AEF7D40040CBFB800F0D17BAF9FD8F27CC1F4B38F79C2DBEAF7CE936F51CBD8
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
903f77a9f3d7ef52de184ba8a277b1dc
SHA1:
b69fd4c47ad0749cf630d45e169006226c7b802b
SHA256:
CAEEA6DFF701A63E2612FF3A08A07411D464D2E9431D3C2FD92DA631F47EFEC3
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
a37f33fd6a6d85a9cdcc5acb8a5b79a9
SHA1:
9df794c4ed27eebb9250554dd8d1ed1c1fc8403b
SHA256:
1E86CE6EC14A1DE64B8326E29A7F02ADE7BDDD4E2B073FCDDB9DB606517C90E1
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
eb0c3e739ead6f5ec6b2f2ccd0d08b73
SHA1:
d9b99dcdb497e536c58fba1656fa754b00f73b12
SHA256:
3B10F032EA2D7E46FBA15B7B51981A4A62F200BB796529F575BE5F74BDE7E376
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
455fddaa95a7161c02b38c6d58edbe86
SHA1:
e43d30e5f9377fa380031ebb200f349cb74093ef
SHA256:
9307FE4C1F23C30FDDF0457CFACB1EEA7EE2246050D8DF255BE2E95A15A4906C
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
22ba333278a3c792c341027372be1994
SHA1:
74dba27db13d9a8fdab3ef2ac0125c488818a314
SHA256:
756F99E511AFF0749B9BAF5A23E3DAA32F977781B863DB775D62E266CED1869F
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c2aeb78538af035f55682c1d8a36bf01
SHA1:
04ef242ed9d88259191d172defd2400b21d21e3d
SHA256:
C321AFEB56DFD60DACEC02653A86AD342DC28A71D4A76450302104D4E8FE8C42
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
62463968b0329c9da47cfadf138e272f
SHA1:
344c2157c8f7ad3905c6831809c3cb55eff56079
SHA256:
BF2EDB8E2384BAF1B45D7C9B8978E8569911451D5E320D7D4CDE5AFB0BDC8A92
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
9d9e2ec80e8356b8aebe38e5b616c4f8
SHA1:
6ba63b0f87a7b14dad69c46b4270bfc1f0ebb865
SHA256:
AE8DC155686AAB9FD38B4F23C061EEB0DB3AF33BC176DD4D6BC99E0335D6C885
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
9e6d4f57bb53e71743b8051e12303162
SHA1:
735c05523cce0a5f6aaf85cc9d63136c45b98426
SHA256:
1D2265266649A87780AA699F2CAA89795E2EBFBB06A747691BC3922107F6CBA6
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
b322bcdd449008be19c58fca923e9282
SHA1:
c386fc55e48f070692993016485e6bcd850a9ccc
SHA256:
BFC042CB4BCC820ACF103CC3573E074CEF994D25E8C3EC153C9AA9B7645F1B44
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
d662f83f0d4cfd7811a684eeb1517850
SHA1:
b990018a9e4fb37867bcfc21fb37fa094ddefeb6
SHA256:
C3878D55B159CDAD25BF55BA8FCE4308EBB69FEEB95DA1A69F196DCB10A99AA9
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
f2088c3432716836a08f3289f3b6ec66
SHA1:
4929822d7b1af93e7a57032aaf4fc8f691bfe55e
SHA256:
476EC71E37BE4F576B267AD0430D4073861FA3BCEB3E01F1F72731C2ED833D0A
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
5c851c044403b8f83230f1440a0c9cf4
SHA1:
a5d28c7f67aa331c7abd251adf80dcde4bd63736
SHA256:
86F7A63086013F64B6C1F3CC372892D52BFEDB3DEA01596BC2BCA46C93C0A083
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
b24897738f77f4b13d4d785517c32548
SHA1:
7c55f5b235c14b3acba07ccd3caaab9e48a92009
SHA256:
86CDC15D1B121D6A7C3A0C70F7E54BDAB8CD3D1D8C3CF2B09A9E8F0C644A10B4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ada6dc55699839c7384879b34ef907e3
SHA1:
9a806af388c030cb32b69ac4cfe7e57afd73cd03
SHA256:
4E50319620E07037C5FA8AA24A1A818086A31B79BCA582B8357F6EDE82A9C8A8
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
48d92dafd438454ce99535142ae0e2dd
SHA1:
59718fd2e927dff674287b89699a754ae7afd99a
SHA256:
E2E5873423F6517A808EAA87D0C280F0E2D3D5032FF397C6414AAC89008B1710
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
44e9853655e2568a004b6a76b50b9bfa
SHA1:
cda35f40b7c9d3dcfe0a7794aef69844653ae9d1
SHA256:
6F3E367A8DF601283F2119501F2B638E5FE4FCE1D3350742FB98172E4F316D36
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
56ecabf5577e165ab90f0084b63d0840
SHA1:
27e15312a30dbd24a33b4f6f12685646883f5992
SHA256:
1CE14648DBF22363B6C65EADB46A02C8551E194C828370DFA48EA61966BD4740
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4da17257cfc3cd52f9d3eed8305830c2
SHA1:
f835736773970709c7a8f64b4f60ba834385594b
SHA256:
2B0E3CD5B48AA42D28598F8AD438A8FA9E18E10B206EC9A2CF0B9B14B51D4D09
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
84355734a26800758ee753d15d9100ad
SHA1:
9f0a1ad007a81f262713bb55906e3d7fbf05fb31
SHA256:
771FEC9AE80F51900EE1E075C81A746F9DA16460A2B6F78F5E4B1C1CDD25D4DC
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
b027a63fc46fc4dfa2521bdf407bf5ee
SHA1:
a8d466d30811978b024b74f25c9eaa81b011f81a
SHA256:
FE5CC7558DB1FFC04C53536D384115358930B0E8D638B105F43B1B6F48528EFF
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
a64e489dd54e5c59da59c0c307cd5132
SHA1:
e7c268ada1f4a078d59eaac653d077caba9431f7
SHA256:
075CCB6D4F66FAEAA2A26A1CF83901486158FCA7D20EC349E6023AF171688C24
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e57726ddabeb137791d97d0891245317
SHA1:
8d05fc423455f8ed6d75bd38167730dc999da325
SHA256:
227145019BB0362FDC397EB3E2440D3220688FCA7D220ED0642BD54A928400D7
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
6d70e15423792ca2c6414b5fe80ad1b8
SHA1:
16fce5709a05bcede3961d8d9df5b5930b5e08f1
SHA256:
9B111B9670A30DF9B9CF220C17436228A7DEF38C57D0AD5B2D4AC5D9D9BAD259
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
374577f8e53497f5db9454bfb6b0ae71
SHA1:
1940542c5c5e9342cef09fe4923efff4c2557cc4
SHA256:
3AD7F4619094192842655A766642870B700D441ABF629FD0CF677EB46F4F9E47
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
0ee0047edb2f4b55fe7228175bfb9ae3
SHA1:
d750d1edfa1302d61b2aaaf3760e7621d718e92c
SHA256:
D839022CB5FFD430B8348680B235F20A0BEAC817B1B827041088D1E9D229CFBC
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
45264cd5da76a5d10a42bc7fed3de6a6
SHA1:
3bf7001018e950e202981801c73d152107b2ab93
SHA256:
920B6D1DAEAB4C1F69DDC38D194C718F0900E5D80CD79481DDA4BDCAB373F722
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
8094d0c64e45e2bc7a3ea14c411fc7cf
SHA1:
0f5b9d7506df96893c52af4e5d8b25a8938ba10c
SHA256:
376BE789B8E65E56AD1DD743DA010ED68CEA4FC48C94380A478B962DDA738D71
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
f8dab1b01d771c33b2f782f495c7333c
SHA1:
bb88544133b256ef8fd4910a61fb3fe0bb5d0c3b
SHA256:
2330D3E3629C235BE37EF38D3EC9F7D715FE882BB0461DB14C7841ECCC24DBCF
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
907958172605339eab83a4e28b57debb
SHA1:
a141c5c15f59ab95adb0cd8d4ef136529de0e014
SHA256:
95ADFBC58AD92BC9366652A8B68494D6F99C03620027E28FAC8CCD2B759E6FC4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
65be3260baef9d58e16a80db6094e1d2
SHA1:
4e190e8e6066eab669ed3109f7578ebdd4e37537
SHA256:
8B35170579701B044C970EF7B438059AE020CD741447AAF7CF24D8BCC03BAD0D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
d3404859f0f64d55425f788612db0b77
SHA1:
6852b3ec45b23a5e5d66eae73212ccc63a2b1c30
SHA256:
83FE0131D7A1A3F91243220C30AC79BFF3D443B9E5AE677BCA9DB885DCEBA9CE
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4dd5f9e511cba4aa3109eabfdeffb8e4
SHA1:
69095b2b6c5a6d277547e3dc72e136e7b1f972f2
SHA256:
A73A2A6A72FD5FB0A182876518AB5B7D93BF8F82CA31D699843AB112E923B8AC
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
9ae9a61965fb95eefee8a961c7c2bbfa
SHA1:
195917ad293882b60c56c936824ab57952bd00d6
SHA256:
D62EDB7FF2F71B67AF09F2D975B4DA43331EA30CFBBFB9FCAFC35A10F433373B
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ce5f164cba7301732314b476c5f9face
SHA1:
2a8a6f49779bb5d3abaa0c2aa57635a8808770b3
SHA256:
F03D5A69753186DF39F0C1DE7EEF2A29C17B847AE6B961C7F99B3EF4327BB1D1
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c561cf7f15f7c6623b4009c39915f623
SHA1:
46fa8966544b2aaa989c542828d188c375067ba8
SHA256:
1C92432E3F0A7E98616397305B056AAF08CF56EAE7D1324F5DC73463F517AFD7
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
f18d17a5bda347373c7c4dd5d1fc2ae2
SHA1:
a5aa78c31dc2dd08d9912e5883b9141fba97f006
SHA256:
639643C0DF378D37015877FCFD0B493DB79C5DD38251E3F36304F6CCB4B9D016
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
439bbdeaaf8c952c647bea8b85041091
SHA1:
2f121c87846bae48cef69bc77f3637fb66236f90
SHA256:
8674F39F89821488DD9237DC7FBEDDFE8429C4ACF577CEA4779274428940C94E
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
de0add2093d1131f89183219675c7450
SHA1:
107e5e609c881533bceb9aed62c8dd6226c10581
SHA256:
E1532C7A6FD7C06B67D073637ABBB860D805FC7E2ABBE14A497CCA66D5FC39ED
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e839967b9d59e14c8cd7882a67f3af4d
SHA1:
50c6cdaa174973d0b407deb3e92971e2c20abee2
SHA256:
42D21D3A2AAFEA191808F2E0EF8412C8D0AFF680D79885F65CD0290A92F93A00
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
28571aa4b4ca37663b910e7ac74be08a
SHA1:
e7214f2b4c29c8d5a0a8a93e6b390919e964ae8a
SHA256:
E4022A11568F28E699450D81FD6868A6F70136E900C5DE2AF56C70DCD96441C4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
2d0843bf91f076e277ff1f1c16c1459a
SHA1:
2bdeea214db5dc68bbef0f5d5e9d80b280e963d5
SHA256:
4714266622D5674EDFDDB8BE183EA68FC9206A8F5ECE3194B3E38CE113897869
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
65e4b1a440cdfe1ef1183b050e3dc865
SHA1:
27ab2901d237b8d9d19c18e768c80248868d2a47
SHA256:
907CF39673A677FEB9A0DBC0DDBFF57401AFC3F2B58479B074F4B7BC02D7648E
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
95b0f8d005a66027f32c1db038adef0b
SHA1:
7f6183c4aaf17dbfb308da664f7eccc4a4af132c
SHA256:
CD819B605CAA0C84AE06DC94E453A15341897BD666C96C175AA76328066A722A
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4b68d26b008772245d9f766ae5c5fa6f
SHA1:
073618868f44f5c19c2c8e29e9ae69553e035d1b
SHA256:
DAB5DD330C53BF376AD1ADE1A0DD474FF48A71CA043E9B8491E1FBD07C2457C7
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
a714907bcbe54202424f56925e0a6ef3
SHA1:
6196641aeb6dccef3710dc163720e15ed4a988df
SHA256:
2A847F4F9D4A2E4A6F67DC48D7E3ABDE732CE3146B4B740DC8CD4B2989413E3F
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
de83be412c286f69cafbeda99e7c4e7e
SHA1:
073ec2af7d238950bbe2540c1090885d86fdd02a
SHA256:
8D0B2F75A1A4559DE2F26B064433DD7304A7ACB5F10AE5A53D45D233DCBC99BF
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
29a23c0b16cd1f76e7b9bca3aaaeae9e
SHA1:
184682744e2e06d8267fd69689de392bcd4f3634
SHA256:
8BFAAADB4F55C167670910EC637016F5F1A21E4214EBE85D596787317059875D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4f9b460008366cea8e51470841b0d821
SHA1:
b0ddb3a6b93c5eceb4f5f441317ab346ad01a0fe
SHA256:
06F509A049D9EF2832D4D4E493F29519F442B85CD1B618BC9C768CFAA014DE3A
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
0c9c4d19305b1ef959129c059aa63003
SHA1:
15a13c9fd0ed2f480310ef73333640be5e63eec5
SHA256:
45E6A93E2DAB3A0B5BF19D37AF565D73C1FF39873E6F13DE331904FF9B8FBBDA
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
81eee70c7769f553be9fac1064956b76
SHA1:
51b43ca00eae7da7c3c5a10a3f7a0d8be13eaa65
SHA256:
EB5A5BAD837CCCB322C1F4C56383A873BA83DCEE548074E25429F9AA6702A4F4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
d420fb5e015b422d49c8219f26dc143f
SHA1:
12e1563a109589b3160762de19c535fb49cd9ad3
SHA256:
F6905FDC4C59D4D435F4EC3BB800CE5BFB9BB5E2FE797810F20CFD7B49F99DF8
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ac2d52b59c54109de020b503ef846d4f
SHA1:
49dc63169aa9a82a1483409d81f978280817127d
SHA256:
05C88D4D2D50AB0BF8C4ACA79A38ED203AE8DA7A7BEE7471E00705ADD3E4AF8B
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c3a6b9e44bf851e6d89572edc0c6fcbc
SHA1:
a4f689707e6c56252028d7222dbb5475dc5efb71
SHA256:
617651C5B25EC7FEA128EA0B94552BB2CD96B5F5A26DC5CA5C1A886512587D5A
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
35d85ed15025e47aa3512e0088303f7d
SHA1:
d5e608f07fd31b86c8693ce8aac13b29d2656a30
SHA256:
1AE36647651BF26098386D2EE9BBBF1E8D6C90DB92DDB0D6E5C9D0B876F72358
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
1864033c677735f7e3775ae4b4ca1b7f
SHA1:
de6f674eb8f1dce74e1e898afe40fb7389953c95
SHA256:
F6EB30D7F7081EBDAE50CFE15B3F3DC53BDAE2C2141519D04F6DE1AB73872CAB
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
472d79c43be6d736c565a195bd1bddc4
SHA1:
0c67cc341f4b112c7d7b221c30dd75a82a263835
SHA256:
8E1A9D2E3C9C92D260BB6C57EE8D9BE91D2EB471747D50EB986183F7721C1B54
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
5c7a691566a451c0e989fa291fddc031
SHA1:
fedc2d3f28dacfa199ab8791cb9e1e679bdd0e2b
SHA256:
D58E35AB7E5560B5E5C19BC23DB18D7352BEDE6E6EA1763D1428A151ED7FED42
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
842e2333ad0d85c244ce74b1f8b3ba2f
SHA1:
39a904bfc36af3c936a759f602f8684604c7935f
SHA256:
1A41DE7362F9AA17E4B7CC5A954FE381C2A014EC4216D08B26B3C2431825E21D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
55769a8f4c7dca89c8d0b3ba9d70d022
SHA1:
65a708898f82fbb6201097dba5fbf140bf1068da
SHA256:
FF2C9C697802E7A0130C2E4B138EED0A7EDF350E311B42C979A9DF9DE1D47FB6
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
a9d90b301ccbac511d5f8694eb6bc124
SHA1:
6bc35525fac50084ffa04b557d500a85fbd7ea4b
SHA256:
96462A327B463D21A1F9D50CF58BAF18E265BC1FC632A10FD649C38E085FF79D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
3587e4b5c909533ac14375c25c1567ce
SHA1:
1dab06959676db45802b03bcbfaa3dcdc66e9470
SHA256:
6427114173E79C0345AA01A7F597B16216F0F9AE3F9D4270A2440C0B6EBCA0DF
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
81a9ca7c285a9449b867108e6003d1ac
SHA1:
5059f4f771936ec16fc5980c4bf320f44b66c8cc
SHA256:
E9E3CEEE5569DC755C63DAF2B9515BDDE19DB6844B0A3F7AC630A0540F8AE573
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c281ad65ccf91e303cf5fc1cba2d463d
SHA1:
f91b7dec4e5d6925970efa5525c8b6dddb3936d6
SHA256:
3A0C86EA5B2E5D07EB1F78DAD6F09FB07AECF6A0225474EA68A90B6D3D1A0F6D
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e2d878177b3ee791905799f3e690a84d
SHA1:
1febb1556eac15f6eb929a153c95e24a4f2fc52d
SHA256:
F4FD8D00858760A42B93E61CF3B50B7E16C41005F6E5ED83DCE3E8AB4785EE10
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
c7049f164128c95b0eccc997551bd242
SHA1:
b6e29e6a3d3ac55e88e9602fd265f5eb56a79008
SHA256:
F54C77F8A07D5D7FEBC99C1FA720114AAB531990A0A91267C34BD73D39811729
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
f3b32836e210e0cba35dade8761dec38
SHA1:
3714effcae8e1d8facff97e62faad285fef511f3
SHA256:
9946975484661E75F261B9A94B064EF4505379BFFF27E0359A1C4B27A86C76B1
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
ea14b1d67d4506314966a233c79e9105
SHA1:
3ef59677d153e7117b005965cd29d4cec444a072
SHA256:
5FE251166B22C1D64850222C39407ADFABDB5D8F5D06DEC1045AAEEFFBB89693
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
482e01ffa96f1a12ad9f74b57020d490
SHA1:
8ba351f43169126d8064c2a82d8b11abbf563c34
SHA256:
4C01B13D0BB4A0223508CA45FC33C4EA242CAAC22A65CE1EDE7AF91EDBD57F07
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4e02aae63a9f494d0b197fd6e36c7ac9
SHA1:
4ad9371c954dd2280810e5423f0c51219bca0bdb
SHA256:
3876A1AD34B60BAC037CAF9AAB4AB27550D4A01F3ABDE6D3D3AF1FF393232F15
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
3f13e8e8ccab1d46a749e4647e46c7e8
SHA1:
ff7732480983703cc8cfe98c0cfc79f8dc3ba494
SHA256:
4543E22AA39EEB32BCBE057B10139399D0C03E640D4D8E5F53365F9646E8A175
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
71f0673aa1a3c9c8c70a26aad1863bd8
SHA1:
2d51e037682ce498aa4926cd7622a6a784a0884e
SHA256:
E171414D32932F78072EA56D47A77CCC11B7518A81DAF79582E28220087914E7
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
eac34e5e246809e14e50575d9574b103
SHA1:
3320a67a7a41f43506314b0061622e06052da846
SHA256:
C60FEE30A264161A65A9A9FC2194A61AEFD6A0705BAB3E36DCA890AACCBCD0B8
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
7897bc0affb43591103a01f14800e69a
SHA1:
78a2fb8827abd18a97f1b61f7fac69b9e82ab0bd
SHA256:
82D2C4C509ABD5E065D338FCF1270DADA52D64A45C2563F11E034C374060F245
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
2a26739d77b08495f465023c245ee476
SHA1:
013e5c0a0424403a94fe7eefa38057b534132236
SHA256:
8DAE6A63C090675310A8FA55CFA9B1752025C0AC6837B4D2CE115BC2AF9E48F5
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
8c5742506d0370a99e824ef32c1c1481
SHA1:
204dfbc9edcd58be742b7124ef266466fd3c395b
SHA256:
6930866913D784C745731F31D2C2DFFFD66C0D5BB4669A09D430ECA409913465
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e2aeb25453ff9a4537edb0393152982f
SHA1:
ff3ce99238baa2ca9388f52d6331e4c0da745429
SHA256:
FD091D9681921B29AD9232B636E4E8863DD2F96964B68E240136D4DE1D21093F
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
246f0d3ed5b69f50d37eec291adb4bf8
SHA1:
10a266a6bcc77b3b64fd3da58341bda9ce195d39
SHA256:
D6C9CB666350C3685D2B1AAF917AFDD17EA5A23520D6D9DFBC997DF9E8BF809C
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
35654a43361aa33aab037cf927c2958c
SHA1:
1bd717ccc915baf857e7136d0c1fcdec9f752884
SHA256:
118991376E834C1CD003F44B24D7C5894C8B34193CDB59FD49FC3D65C149439A
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
042a6d518557139ae715d8c7a09a8ad6
SHA1:
25995ae1ea08ff592d5a950a28c13643b3dcaf7e
SHA256:
09E30B847005B63E9CA2A33DA91FC4A8A57A5AE0E5893CB5BA5551ED145F279C
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
b793faae87f8abca7dc0c2d6c496ecde
SHA1:
d71ea407a955fd072217bea2854cc16ba3d61a74
SHA256:
627A902144EE7B14EDCF8807C6259AC3F1EE2215A1349C70AA8AC891B9501EDE
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
0911ec10a0c53d2a81b742c19b662596
SHA1:
2a60f63c37ffa3c3f714ae7995568168c689cb4a
SHA256:
5358C72BABAE52765FD771ED0F5D7F2F553A51B5670A83C5A3C83331F0B1A235
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
4f29c6d6d7975466658fea0d9b0b5f03
SHA1:
7438325a5218b3440dd57bd92e68a5d428255ab5
SHA256:
56FD8615B2C179F2CDA5782C62D59534CAC5B9DFFA6ACDBF68382A6FF4A43EC9
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
e0a95f42862c4add6a529fc516be87f6
SHA1:
854aa629ceebff476dd63d8ef16a10f3df34a159
SHA256:
8EF0852BEFE470BC25B853706D5603EB302AAC12F04CEF94CC6B7A7DA1C5E1C4
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
31250d28bbf551764dd2a88af6d36b21
SHA1:
cefc1ec996d398891c44c25ed7b3567bfc27b092
SHA256:
403D0C49EE3E8C1828990758CD2F38858608F1E468F28FBCA9E38A16504135B7
File Size:
4.14 MB, 4143368 bytes
|
|
MD5:
d67af7a44c156ffd2d326d81a872ecae
SHA1:
de665c8ce9e66ccc5608b2b57c53f0a33a4ae1c7
SHA256:
E1B7E4630AC10C92196281DDE79AB842BD9BEEFA5BA8D73730BEFA015288862B
File Size:
4.14 MB, 4143368 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.1.6597 |
| Company Name | ISP001 |
| File Description | Software Installation |
| File Version | 1.0.1.6597 |
| Internal Name | ISP001.exe |
| Legal Copyright | Copyright © Adaware 2023 |
| Original Filename | GenericSetup.exe |
| Product Name | InstallPPI Web |
| Product Version | 7.14.2.0 |
File Traits
- .NET
- HighEntropy
- Installer Version
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 82 |
|---|---|
| Potentially Malicious Blocks: | 6 |
| Whitelisted Blocks: | 76 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- MSIL.Bundler.D
- MSIL.ClipBanker.ACJ
- MSIL.ClipBanker.TQ
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2odal.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2odal.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2omodels.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2omodels.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oservices.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oservices.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2outilities.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2outilities.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oviewmodels.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\h2oviewmodels.dll.lock | Generic Write,Read Attributes,Delete |
Show More
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\htmlagilitypack.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\htmlagilitypack.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\msvcp140.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\msvcp140.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\ninject.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\ninject.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\offersdk.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\offersdk.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\sciterwrapper.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\sciterwrapper.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.net.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.net.dll.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\vcruntime140.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\vcruntime140.dll.lock | Generic Write,Read Attributes,Delete |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey |
Show More
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dhbdvzwc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dhbdvzwc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qlwgbrqd\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qlwgbrqd\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Qlwgbrqd\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Lcbrcegw\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Lcbrcegw\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Lcbrcegw\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rszslsqx\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rszslsqx\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Rszslsqx\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Waavvhpi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Waavvhpi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Waavvhpi\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Tnweotbb\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Tnweotbb\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Tnweotbb\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jqezlcjp\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jqezlcjp\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Jqezlcjp\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Akvdpiji\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Akvdpiji\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Akvdpiji\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Kxvvnmok\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Kxvvnmok\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Kxvvnmok\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Crzbdlbh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Crzbdlbh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Crzbdlbh\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Beduqkxk\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Beduqkxk\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Beduqkxk\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hkcbqmbc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hkcbqmbc\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Hkcbqmbc\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rndapcoj\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rndapcoj\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Rndapcoj\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cstacxuf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cstacxuf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Cstacxuf\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dmuajcdo\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dmuajcdo\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dmuajcdo\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hthxfnsv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hthxfnsv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Hthxfnsv\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hthxfnsv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.Net.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hthxfnsv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.Net.dll \??\C:\Users\Hthxfnsv\AppData\Loc | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abitnlso\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abitnlso\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Abitnlso\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abitnlso\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\HtmlAgilityPack.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abitnlso\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\HtmlAgilityPack.dll \??\C:\Users\Abitnlso\AppData\Loc | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rauabssg\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Rauabssg\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Rauabssg\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Brgkqdlm\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Brgkqdlm\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Brgkqdlm\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Saajrjep\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Saajrjep\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Saajrjep\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Clhnydzf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Clhnydzf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Clhnydzf\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hoijmhnq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hoijmhnq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Hoijmhnq\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hmhermdh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hmhermdh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Hmhermdh\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Immmdjtt\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Immmdjtt\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Immmdjtt\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Velxvdou\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Velxvdou\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Velxvdou\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Sythgvaf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Sythgvaf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Sythgvaf\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Eurcyfcg\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Eurcyfcg\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Eurcyfcg\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Zhbvopvw\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Zhbvopvw\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Zhbvopvw\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Fhastoai\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Fhastoai\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Fhastoai\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Uvdmlypj\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Uvdmlypj\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Uvdmlypj\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dpzokzhq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dpzokzhq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Dpzokzhq\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Icpesmak\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Icpesmak\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Icpesmak\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pcflczmv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pcflczmv\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Pcflczmv\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ecahcwzf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ecahcwzf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Ecahcwzf\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pfhtwchf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pfhtwchf\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Pfhtwchf\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ycyuljsq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Ycyuljsq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Ycyuljsq\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Natkghhy\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Natkghhy\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Natkghhy\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pnnjvqlh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pnnjvqlh\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Pnnjvqlh\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jyjctgoi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jyjctgoi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Jyjctgoi\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Juddbaoq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Juddbaoq\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Juddbaoq\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cdaeyqym\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cdaeyqym\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Cdaeyqym\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Maedgbxi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Maedgbxi\AppData\Local\Temp\3354215998cc498efdf76f123473fe62\ServiceHide.dll \??\C:\Users\Maedgbxi\AppData\Local\T | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9 \??\C:\Windows\SystemTemp\a0193845-cda1-440d-a413-f72234d438ee.tmp \ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9 \??\C:\Windows\SystemTemp\dc485b95-8580-4f04-8219-e35cd52eb4bd.tmp \ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\0550f60d-8e7d-4397-81e4-da3409df71dc.tmp \??\C:\Windows\SystemTemp\d03330c9-16b7-442d-bb78-afb76b926a | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9 \??\C:\Windows\SystemTemp\b1a39cca-eadf-4949-a384-a0ef6a3b3fd2.tmp \ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\77e37ce0-8214-4414-aced-551c5ae204d7.tmp \??\C:\Windows\SystemTemp\e28eadcf-6ab0-4d8c-8821-7ce9a6aba1 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\a9dd6c3f-d641-4292-855a-e9c09c1b694b.tmp \??\C:\Windows\SystemTemp\85968c61-a19d-4e7b-a80f-d2a1fc3c08 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\111339\5768\c\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\111339\5768\c\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll *1\??\C: | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\111925\6916\c\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\111925\6916\c\users\user\appdata\local\temp\3354215998cc498efdf76f123473fe62\servicehide.dll *1\??\C: | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| User Data Access |
|
| Anti Debug |
|
| Encryption Used |
|
| Other Suspicious |
|
