Multi-License Discount Quote

Change Region

English
Threat Database Trojans Trojan.MSIL.FakeMS.O

Trojan.MSIL.FakeMS.O

By CagedTech in Trojans

Threat Scorecard

Popularity Rank: 10,788
Threat Level: 80 % (High)
Infected Computers: 148
First Seen: May 3, 2022
Last Seen: November 28, 2025
OS(es) Affected: Windows

Analysis Report

General information

Family Name: Trojan.MSIL.FakeMS.O
Signature status: No Signature

Known Samples

MD5: e97d10ee7109a10dc0917b2db9d9b595
SHA1: 95aeb051debcb97ca4cb9a94e24b62c33a655cc7
SHA256: B25C1807502D6F28A3621B4A3A29B4FC43DD94D7CBB6B891A3F111839E8CCACD
File Size: 37.89 KB, 37888 bytes
MD5: 932a203c157f3e8ce97dbaf94bd5175f
SHA1: 0f916c03d58ccae00c0d07053e3b36d81625892f
SHA256: FA7CCC8BAAFB7C58AC377786DB147AD6AD7DBE3385AC339F23C4FA134FDC296F
File Size: 38.40 KB, 38400 bytes
MD5: db4063ca08c8dff2cd426554b32963b3
SHA1: ff37685d26aae818feee7862726602aa68674c5a
SHA256: B4883E351AFA0F81709ED7D1B7E92FD3035FAD854E5D5290219276103B56F6C8
File Size: 54.78 KB, 54784 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

File Traits

  • .NET
  • NewLateBinding
  • No Version Info
  • ntdll
  • x86

Block Information

Total Blocks: 48
Potentially Malicious Blocks: 32
Whitelisted Blocks: 16
Unknown Blocks: 0

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x 0 x x x x x x x x x x x x x 0 x x x x 0 x x x x 0 x x x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • MSIL.FakeMS.O

Files Modified

File Attributes
Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
Generic Write,Read Attributes
Generic Write,Read Attributes,Delete,LEFT 262144
Generic Write,Read Data,Read Attributes,Delete,LEFT 262144
c:\autorun.inf Generic Write,Read Attributes
c:\autorun.inf Synchronize,Write Attributes
c:\svchost.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\svchost.exe Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\2bc2da243b888ddb954888782e6bdaa2.exe Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\2bc2da243b888ddb954888782e6bdaa2.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
Show More
c:\users\user\appdata\roaming\r.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\downloads\0f916c03d58ccae00c0d07053e3b36d81625892f_0000038400 Synchronize,Write Attributes
c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888 Synchronize,Write Attributes
c:\users\user\downloads\ff37685d26aae818feee7862726602aa68674c5a_0000054784 Synchronize,Write Attributes
c:\windows\fpqkri2o035ri20rkj34534fger Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

Key::Value Data API Name
HKCU::di ! RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 魏◂⻊ǜ RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe 螱◎⻊ǜ RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
Show More
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::2bc2da243b888ddb954888782e6bdaa2 "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" .. RegNtPreCreateKey

186 additional registry modifications are not displayed above.

Windows API Usage

Category API
User Data Access
  • GetComputerName
  • GetUserName
  • GetUserObjectInformation
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
Process Shell Execute
  • CreateProcess
  • ShellExecuteEx
  • WriteConsole
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
Show More
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • UNKNOWN
  • win32u.dll!NtGdiAnyLinkedFonts
  • win32u.dll!NtGdiBitBlt
  • win32u.dll!NtGdiCreateBitmap
  • win32u.dll!NtGdiCreateCompatibleBitmap
  • win32u.dll!NtGdiCreateCompatibleDC
  • win32u.dll!NtGdiCreateDIBitmapInternal
  • win32u.dll!NtGdiCreateRectRgn
  • win32u.dll!NtGdiCreateSolidBrush
  • win32u.dll!NtGdiDeleteObjectApp
  • win32u.dll!NtGdiDoPalette
  • win32u.dll!NtGdiDrawStream
  • win32u.dll!NtGdiExtGetObjectW
  • win32u.dll!NtGdiExtTextOutW
  • win32u.dll!NtGdiFontIsLinked
  • win32u.dll!NtGdiGetCharABCWidthsW
  • win32u.dll!NtGdiGetDCDword
  • win32u.dll!NtGdiGetDCObject
  • win32u.dll!NtGdiGetDeviceCaps
  • win32u.dll!NtGdiGetDIBitsInternal
  • win32u.dll!NtGdiGetEntry
  • win32u.dll!NtGdiGetFontData
  • win32u.dll!NtGdiGetGlyphIndicesW
  • win32u.dll!NtGdiGetOutlineTextMetricsInternalW
  • win32u.dll!NtGdiGetRandomRgn
  • win32u.dll!NtGdiGetRealizationInfo
  • win32u.dll!NtGdiGetTextFaceW
  • win32u.dll!NtGdiGetTextMetricsW
  • win32u.dll!NtGdiGetWidthTable
  • win32u.dll!NtGdiHfontCreate
  • win32u.dll!NtGdiIntersectClipRect
  • win32u.dll!NtGdiQueryFontAssocInfo
  • win32u.dll!NtGdiSelectBitmap
  • win32u.dll!NtGdiSetLayout
  • win32u.dll!NtGdiStretchDIBitsInternal
  • win32u.dll!NtUserBeginPaint
  • win32u.dll!NtUserBuildHwndList

59 additional items are not displayed above.

Keyboard Access
  • GetAsyncKeyState
  • GetKeyState
Other Suspicious
  • AdjustTokenPrivileges
Process Terminate
  • TerminateProcess
Network Winsock2
  • WSAConnect
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
Encryption Used
  • BCryptOpenAlgorithmProvider
  • CryptAcquireContext
Network Winsock
  • closesocket
  • freeaddrinfo
  • getaddrinfo
  • inet_addr
  • send
  • setsockopt
Service Control
  • OpenSCManager
  • OpenService
Process Manipulation Evasion
  • NtUnmapViewOfSection

Shell Command Execution

netsh firewall add allowedprogram "c:\users\user\downloads\95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" "95aeb051debcb97ca4cb9a94e24b62c33a655cc7_0000037888" ENABLE
taskkill /F /IM Exsample.exe
WriteConsole: ERROR: CoInitial
(NULL) C:\WINDOWS\fpqkri2o035ri20rkj34534fger
(NULL) C:\Users\Gyxkqscw\AppData\Roaming\r.exe
Show More
netsh firewall add allowedprogram "C:\Users\Gyxkqscw\AppData\Roaming\r.exe" "r.exe" ENABLE

Related Posts

Trending

Most Viewed

Loading...