Threat Database Trojans Trojan.Badjoke

Trojan.Badjoke

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 3,323
Threat Level: 10 % (Normal)
Infected Computers: 5,179
First Seen: April 5, 2012
Last Seen: October 4, 2026
OS(es) Affected: Windows

The detection of Trojan.Badjoke on your system indicates a potential security threat that requires immediate attention. This report provides an overview of the threat, its characteristics, and steps to remove it from your computer.

What Is Trojan.Badjoke?

Trojan.Badjoke is a type of malware that can compromise the security and integrity of your system. The term "Trojan" refers to a broad category of malicious software that disguises itself as legitimate programs, allowing it to bypass security defenses and gain unauthorized access to a computer. Trojan.Badjoke, by its detection name, suggests it may exhibit behaviors typical of Trojans, such as remote access capabilities, data theft, or the installation of additional malware.

How Trojan.Badjoke Operates

Malware like Trojan.Badjoke typically operates by exploiting vulnerabilities in software or tricking users into executing the malicious code. Once installed, it can perform a variety of harmful actions, including but not limited to, stealing sensitive information, downloading and installing other malware, or allowing unauthorized access to the infected computer. The specific operations of Trojan.Badjoke would depend on its design and the intentions of its creators, but like other Trojans, it is likely designed to remain stealthy and avoid detection.

Symptoms of Infection

Identifying a Trojan.Badjoke infection can be challenging due to its stealthy nature. However, common symptoms of malware infections include unusual system behavior, such as slow performance, frequent crashes, or the appearance of unwanted programs or toolbars in your web browser. You might also notice unexpected changes to your system settings or unusual network activity. Since Trojans can be used to download and install other types of malware, the presence of Trojan.Badjoke could lead to a wide range of symptoms depending on the additional malware installed.

How to Remove Trojan.Badjoke

  1. Boot your computer in Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode allows you to use the internet to download removal tools while limiting the operation of most malware.
  2. Download and run a full scan with a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated with the latest definitions to improve the chances of detecting and removing Trojan.Badjoke.
  3. Uninstall suspicious programs that you do not recognize or that were installed around the time you noticed the infection. Be cautious and only uninstall programs you are certain are malicious or unnecessary.
  4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings. This can help remove any malicious extensions or settings changes made by the malware.
  5. After completing the above steps, reboot your computer and perform another scan with your anti-malware tool to ensure that all traces of the malware have been removed.

Conclusion

The removal of Trojan.Badjoke requires careful and systematic steps to ensure that all components of the malware are eliminated from your system. It is crucial to act promptly to prevent further damage or data theft. After removal, consider taking additional security measures, such as updating your operating system and software, using strong, unique passwords, and being cautious with emails and downloads to protect against future infections. Remember, vigilance and proactive security practices are key to maintaining the security and integrity of your computer system.

SpyHunter Detects & Remove Trojan.Badjoke

File System Details

Trojan.Badjoke may create the following file(s):
Expand All | Collapse All
# File Name MD5 Detections
1. VS Revo Group---Virus Boss!!!!!!!.vbs d68479c58d8ff342d3721bdffe8a0220 183
2. friend.exe b2b63a8ce53e18f9dc70bbccf42ede83 10

Analysis Report

General information

Family Name: PUP.Badjoke
Signature status: No Signature

Known Samples

MD5: ae1aa2de6b8be19775f356e78349c0c7
SHA1: ca8c0565373312867cec2f2f6650d2708c03499b
File Size: 64.00 KB, 64000 bytes
MD5: 8db2bc4ed355239adc629409ee80a156
SHA1: 1ee48acf095fad37b022fe16b95cb17e42fd557f
File Size: 419.84 KB, 419840 bytes
MD5: 0a137e56a8ff25fd0cef22d970142d82
SHA1: 2fca749ff8f9d57c56e0873c9ee788c6cacd3323
SHA256: 5F93BF831407B99E8D5F7CDECACB3E729CCB951FC6220B4D9D884A58B8CA856A
File Size: 153.09 KB, 153088 bytes
MD5: 6931cf934847b2f341fc34e36cd7bf9f
SHA1: 3b48f80706b63b5e102bef92822158af8e4c2a86
SHA256: E32E8C77D5191005B03AAC3918A7A46569F6278FE1CDF8DC4BAD6F4E90FFFF01
File Size: 4.54 MB, 4535135 bytes
MD5: 0b02384d96a7d1aa046618bad40c0a69
SHA1: fb2d41f057215c52530c23dce863c08c1027c334
SHA256: 00D0AA34A4F90864B05F340A27808AF18E9CDE73108F866A902D1915A72430EB
File Size: 267.26 KB, 267264 bytes
Show More
MD5: d4163d85ba71a09b181dea459744698c
SHA1: 002efbdaf3b87a486cd1b577b219a36995a66489
SHA256: 1FD51D6DD83F903B81C2FE5EE5811A32F4EEDDAE97B02C89659E6F0E7DA16B1E
File Size: 613.38 KB, 613376 bytes
MD5: 8ed8f5c96b0a178fb2c5855729f2af0e
SHA1: a2c368f0145546d7991079b71f189435d301d80c
SHA256: D3029297E1B684901D7C7A82A5A80B24B7867CC9CD27F2D5F5E090C2E41CF661
File Size: 552.96 KB, 552960 bytes
MD5: e4a61690469507d6da1496c231acc055
SHA1: 42921c9d12286d95594de1c17a60006d6b4f5895
SHA256: 0C16FB3F6EBAEF29004AE74F333774C739CD7BAD324ECD3459945693FBE01AAE
File Size: 1.62 MB, 1624064 bytes
MD5: 7b3ea5dac8969f4020466d00bf7133a3
SHA1: dfa459726cae28867cd70d58cfcc2678c7b7b3df
SHA256: 57C6F89356DAC3F8835F56EC506DD52C93C68682531B15C7CD9F581DAB30EB0C
File Size: 200.62 KB, 200625 bytes
MD5: e3e1474f616defb6421ea8a03a8a7a98
SHA1: 551049efaec4093386d254b94038ab53c59d598a
SHA256: FC5FD12701701B4538578B5A721BB4C8F0DE019C8C31D34A0C96025985312DE9
File Size: 242.18 KB, 242176 bytes
MD5: e38cef3ca4d6b2babc0bd21c34a56419
SHA1: 6274e256cd7c5c219d92c524149e26fa0c97dc2c
SHA256: 60DC04E2DA68BAE8D58D05D35E048BC0DE72D81BA2FCCDDF93F0977940C4AEB1
File Size: 2.64 MB, 2635776 bytes
MD5: f41d27a5431a3a02121581c13cd7cc18
SHA1: 86fd28a026a57fa50993bd032cd1166b0c5715fa
SHA256: 0D8AFE0655E774394E993451A522688B9C8B1AE11F5DA441BFB645F401AE6A6C
File Size: 996.31 KB, 996306 bytes
MD5: 5bf844bf7e11cc22ca83d49d803dd936
SHA1: 00091963d99ac9779df3d7942097db7ec3b6c820
SHA256: 7E902B2330D0DEA74E51844C98F5AAADDC8C8E19C8E885E0E50BD85A4B760259
File Size: 235.01 KB, 235008 bytes
MD5: 61697804686b8945a6664ac63b7ef861
SHA1: ee79f753c8209bb3f749c6934ad8c4e525b608ad
SHA256: 49FF58131775C4FF389FBAA69FC157DC91519790BB046ACB8D5C67B121DC4D35
File Size: 361.24 KB, 361236 bytes
MD5: 122897b2a6c074b0b61c69330475c383
SHA1: 813105eaffd889fc322e1bf738efe7e8ae0d377b
SHA256: 5DBD41E101F1BCEBB1EF838A5CBC1CDD516B778D405AFE8F7B2425BDEE2AD73A
File Size: 3.05 MB, 3052032 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has been packed
  • File has exports table
  • File has TLS information
  • File is .NET application
  • File is 32-bit executable
Show More
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version
  • 1.0.8.0
  • 1.0.1.0
  • 1.0.0.0
  • 0.9.8.0
Command Line -p "[path]" -t "[file types]" -f "[find what]" -i include subdirs -c case sensitive search.exe -p "c:\windows" -t "*.htm" -f "Microsoft" -c -i
Comments
  • AutoRun Wizard is a product of RJL Software, Inc.
  • For more FREE software visit our website.
  • For more FREE useful software visit our website.
  • For more free utilities visit www.rjlsoftware.com
  • Made by malwareman https://www.youtube.com/channel/UCk8Gj-r2kQdCkleLtKWz7rQ
Company Name
  • chenstack
  • MALWAREMAN
  • ResidentEvil4Re
  • RJL Software, Inc.
  • RJL Software, Inc.
  • YouAreAnIdiot-UnFlash
Compay Name Freeverse Software
Email support@rjlsoftware.com
File Description
  • Configures an AutoRun for Windows CD-ROMs
  • Displays your installed Windows Product Key
  • Maltoolkit
  • Palworld
  • ResidentEvil4Re
  • Resizes browsers to default screen resolutions
  • Setup Launcher
  • Simple file search and replace utility
  • Virtual Viagra
  • YouAreAnIdiot-UnFlash
File Version
  • 2018.2.21.10560245
  • 3.01.0000
  • 2.0.1.0
  • 2.0.0.0
  • 1.0.8.0
  • 1.0.6.0
  • 1.0.2.0
  • 1.0.1
  • 1.0.0.0
  • 1.0
Show More
  • 0.9.8.0
Internal Name
  • autorun
  • Maltoolkit.exe
  • Palworld.exe
  • ResidentEvil4Re.exe
  • resize
  • Simple Search and Replace
  • Windows Product Key Viewer
  • YouAreAnIdiot-UnFlash.exe
Legal Copyright
  • 749
  • chenstack
  • Copyright 2002-2004, RJL Software, Inc.
  • Copyright 2002-2007, RJL Software, Inc.
  • Copyright 2003, RJL Software, Inc.
  • Copyright 2005-2025, RJL Software, Inc.
  • Copyright © 1998
  • Copyright © MALWAREMAN
Legal Trademarks
  • None
  • None.
Original Filename
  • autorun.exe
  • Maltoolkit.exe
  • Palworld.exe
  • ResidentEvil4Re.exe
  • resize.exe
  • search.exe
  • winproductkey.exe
  • YouAreAnIdiot-UnFlash.exe
Product Name
  • AutoRun Wizard
  • Maltoolkit
  • Net Send Lite
  • Palworld
  • ResidentEvil4Re
  • Resize Browser
  • Simple Search and Replace
  • Windows Product Key Viewer
  • YouAreAnIdiot-UnFlash
Product Version
  • 2018.2.21.10560245
  • 3.01.0000
  • 2.0.1.0
  • 2.0.0.0
  • 1.0.8.0
  • 1.0.6.0
  • 1.0.2.0
  • 1.0.1
  • 1.0.0.0
  • 1.0.0+064a9570ce830d22cec9be8263e34b14527277d6
Show More
  • 1.0
Unity Version 2018.2.21f1_a122f5dc316d
Website
  • www.rjlsoftware.com
  • www.rjlsoftware.com www.AutorunWizard.com

File Traits

  • .adata
  • .aspack
  • .NET
  • Agile.net
  • ASPack v2.12
  • big overlay
  • CreateThread
  • Fody
  • HighEntropy
  • Installer Manifest
Show More
  • Installer Version
  • No Version Info
  • packed
  • SmartAssembly
  • VirtualQueryEx
  • WriteProcessMemory
  • x64
  • x86

Block Information

Total Blocks: 8,988
Potentially Malicious Blocks: 306
Whitelisted Blocks: 3,382
Unknown Blocks: 5,300

Visual Map

x 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 ? 0 ? 0 0 ? ? ? ? 0 ? ? ? 0 ? ? 0 ? ? 0 ? 0 0 0 ? ? 0 0 ? ? 0 ? ? 0 ? 0 0 0 ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? x ? ? 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 0 ? ? 0 ? 0 ? 0 ? 0 ? ? 0 0 ? 0 0 ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 0 ? 0 0 ? ? ? ? ? 0 ? 0 0 0 ? ? ? ? x x ? ? 0 x ? ? 0 0 ? 0 0 ? ? ? ? ? 0 0 0 0 ? 0 0 ? ? 0 ? x ? x ? x ? 0 0 0 ? ? ? 0 0 x 0 0 0 0 ? ? ? 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 x 0 0 ? 0 ? 0 0 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? ? 0 0 0 0 ? ? ? 0 ? 0 ? ? ? 0 ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? 0 0 ? x 0 0 0 0 0 0 0 0 0 ? 0 0 x ? ? ? 0 0 ? ? ? 0 ? ? 0 ? x ? ? ? 0 ? ? 0 ? 0 0 ? ? ? ? ? 0 0 0 ? 0 0 ? ? ? 0 ? ? 0 ? 0 0 ? ? 0 0 0 0 0 0 0 0 ? ? 0 0 ? 0 ? 0 ? 0 ? 0 0 ? 0 0 ? 0 ? 0 0 ? 0 0 ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? 0 ? ? ? 0 ? 0 ? ? 0 ? 0 0 x ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? 0 x ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? 0 0 ? ? ? 0 0 0 ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? x 0 0 0 x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x x ? 0 0 0 0 ? ? ? 0 0 0 ? ? 0 0 ? ? 0 ? ? 0 ? 0 0 0 ? 0 ? 0 ? ? 0 0 0 0 ? 0 0 0 ? ? ? ? 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? x 0 ? 0 0 0 0 0 0 0 ? 0 ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? x ? ? ? 0 0 ? ? 0 ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 ? ? ? ? 0 ? ? 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? ? 0 0 x x x 0 ? ? ? ? 0 x ? ? ? 0 x ? ? ? ? 0 ? ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? 0 0 0 ? ? 0 0 0 ? ? ? 0 ? ? 0 ? 0 0 0 0 ? ? ? ? 0 ? ? 0 ? 0 ? 0 0 0 ? ? ? 0 ? ? 0 ? 0 ? 0 0 ? ? ? ? ? ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 0 ? ? 0 0 ? 0 ? 0 ? 0 ? ? 0 0 ? 0 ? 0 0 0 0 0 0 ? ? 0 0 ? ? 0 0 0 0 0 ? 0 0 ? ? ? ? ? ? 0 0 0 ? 0 ? ? ? ? 0 ? ? 0 ? 0 0 0 0 ? ? ? 0 ? ? 0 ? 0 ? 0 0 ? ? 0 ? ? 0 ? 0 0 0 0 ? ? 0 ? ? 0 ? 0 0 ? 0 ? 0 0 0 0 ? 0 ? ? 0 ? ? 0 ? 0 ? 0 0 0 0 ? ? 0 ? ? 0 ? 0 ? 0 ? x 0 0 ? 0 ? ? ? ? ? ? ? ? 0 ? 0 0 ? 0 0 ? ? ? 0 0 ? 0 0 0 0 ? ? 0 0 ? ? ? ? x 0 ? ? ? 0 ? ? 0 ? ? 0 ? 0 0 0 0 ? 0 0 0 ? 0 ? ? ? 0 ? 0 0 0 0 x 0 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 ? 0 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? 0 ? 0 ? x ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? ? 0 ? ? 0 0 ? ? 0 ? ? 0 ? 0 ? 0 0 ? 0 ? ? 0 ? ? ? ? 0 ? 0 0 ? 0 0 ? ? ? 0 0 0 0 0 0 0 ? 0 0 ? ? ? 0 ? ? 0 ? 0 0 0 0 0 ? ? ? 0 0 ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? 0 0 0 0 ? 0 ? ? 0 0 ? ? ? ? 0 ? 0 ? ? ? ? 0 ? 0 ? 0 ? ? 0 ? ? 0 ? 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? ? 0 0 0 0 ? ? 0 0 ? ? ? ? ? 0 ? ? ? 0 0 ? ? ? 0 0 ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? 0 0 ? 0 0 0 0 0 0 0 ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? ? 0 0 0 ? ? ? 0 ? ? 0 ? 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? 0 0 ? ? 0 ? 0 ? ? ? 0 ? 0 0 0 0 ? 0 0 0 ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? 0 0 0 ? 0 ? ? 0 ? 0 ? ? ? ? 0 0 ? ? ? 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? x ? 0 ? ? ? ? ? ? ? 0 0 ? ? 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 0 0 x 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 0 ? ? ? ? 0 ? ? 0 0 0 ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? 0 ? ? ? ? 0 ? ? 0 ? ? 0 0 ? ? 0 0 ? 0 0 ? ? 0 0 0 0 0 0 ? 0 x x 0 ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 ? 0 ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? x ? ? ? ? ? 0 x ? 0 0 0 ? 0 0 ? ? 0 ? ? ? 0 ? ? ? 0 0 ? ? 0 x 0 x 0 x 0 x ? ? ? ? 0 ? ? ? ? ? ? 0 ? 0 ? ? x ? 0 ? 0 x ? ? ? ? 0 ? ? ? 0 ? ? ? ? 0 ? 0 ? ? 0 ? 0 0 ? ? ? ? 0 ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? x x ? ? ? ? ? ? ? ? ? 0 x 0 ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 ? 0 ? ? 0 ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 ? ? 0 ? ? 0 ? 0 0 0 0 0 ? 0 ? ? ? ? 0 0 ? 0 ? 0 0 0 ? ? 0 ? 0 0 0 0 ? 0 ? ? ? 0 0 ? ? ? ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Bancos.B
  • CobaltStrike.XAA
  • Farfli.FR
  • Fugrafa.T
  • Injector.DFF
Show More
  • Injector.DGB
  • Injector.FGSA
  • Injector.FHBF
  • Injector.FHBG
  • Injector.FHBH
  • Injector.FHE
  • Injector.GDSA
  • Injector.KKF
  • LegendMir.B
  • Remcos.W
  • Shipup.AG
  • Sohanad.A
  • Trojan.Kryptik.Gen.EHC

Files Modified

File Attributes
\device\namedpipe\gmdasllogger Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1.tmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\_is74c1\0x0409.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1\_ismsidel.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\_is74c1\net send lite.msi Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_is74c1\setup.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\_msi5166._is Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\ccleaner.ico Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\delayexec.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\installer.bmp Generic Write,Read Attributes
Show More
c:\users\user\appdata\local\temp\nsb379f.tmp\installer.ico Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\installer2.ico Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\modern-wizard.bmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\nsdialogs.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\setup1.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\setup1.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\setup2.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\setup2.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\sms1.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\sms1.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\sms2.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\sms2.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\sms3.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nsb379f.tmp\sms3.ini Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\smsplus_small.bmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\sysopt2015-setup.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\system.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\systemoptimizer_ico.bmp Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb379f.tmp\userinfo.dll Generic Write,Read Attributes
c:\users\user\appdata\local\temp\wzsb868.tmp Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~74b0.tmp Generic Write,Read Attributes
c:\windows\downloaded installations\{52df3883-6f28-4253-b39e-77338c33e13b}\net send lite.msi Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

Key::Value Data API Name
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::fdwsupport  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::cformattags  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::aformattagcache  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.imaadpcm::cfiltertags RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::fdwsupport  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::cformattags  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::aformattagcache 2 RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msadpcm::cfiltertags RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msg711::fdwsupport  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msg711::cformattags  RegNtPreCreateKey
Show More
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msg711::aformattagcache  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msg711::cfiltertags RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::fdwsupport  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::cformattags  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::aformattagcache 1 RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.msgsm610::cfiltertags RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::fdwsupport  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::cformattags  RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::aformattagcache U RegNtPreCreateKey
HKLM\software\microsoft\audiocompressionmanager\drivercache\msacm.l3acm::cfiltertags RegNtPreCreateKey
HKCU\software\freeverse\viagra::1 1 1 RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 _nO�"a �� �v ��T�������Bx"Wc&� (�(X�)�`*9*�",=�1`1�1HO@V�A��D�N$N�U_*_�zb"hc�we�vj�bk`k�ql(�lR o�wp*tǤw�my�9{b�~D�P��jI�/������7�b:������� �����q�X�������.�a  RegNtPreCreateKey

Windows API Usage

Category API
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
User Data Access
  • GetComputerName
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserName
  • GetUserObjectInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Encryption Used
  • BCryptOpenAlgorithmProvider
  • CryptAcquireContext
Syscall Use
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtCancelTimer2
  • ntdll.dll!NtCancelWaitCompletionPacket
  • ntdll.dll!NtClearEvent
Show More
  • ntdll.dll!NtClose
  • ntdll.dll!NtCompareSigningLevels
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtGetCachedSigningLevel
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtNotifyChangeKey
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtPowerInformation
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtUnsubscribeWnfStateChange
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtYieldExecution
  • UNKNOWN

Shell Command Execution

MSIEXEC.EXE /i "C:\WINDOWS\Downloaded Installations\{52DF3883-6F28-4253-B39E-77338C33E13B}\Net Send Lite.msi" SETUPEXEDIR="c:\users\user\downloads"