Trojan.NSIS.Generic
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 811 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 20,981 |
| First Seen: | April 10, 2024 |
| Last Seen: | April 22, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.NSIS.Generic |
|---|---|
| Signature status: | Self Signed |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
3dd241ecf803a4553e24bdbd4ae72f12
SHA1:
f40673a1433736af298d3c2ea7a731fbea2f53c5
File Size:
2.20 MB, 2196648 bytes
|
|
MD5:
e9971ed70edd20705a2144ae825c7c72
SHA1:
33d8ea9abb1241f5d67e01263695776c238ad4ae
File Size:
282.21 KB, 282211 bytes
|
|
MD5:
dc93c9cadb782b115faf4439f1785488
SHA1:
a14638759ce195a0cf63e07f7a5545c97a69fab4
File Size:
1.02 MB, 1023832 bytes
|
|
MD5:
4b6fd5ac9ddd97453c0f206a78857156
SHA1:
a0aaa6a1ed6243f0601bb3ed3cd8ad1065b0f5be
File Size:
1.01 MB, 1007800 bytes
|
|
MD5:
45b44ca2bb8c15d69960e080e6881b1e
SHA1:
6416f735d1d72367358ad06de96f7cdc9f8c8454
File Size:
71.93 KB, 71929 bytes
|
Show More
|
MD5:
a19fa7a664183d4546c5d6134481fae4
SHA1:
4cd4f4881056de30f84a15fb2676a8344d3b4506
File Size:
655.35 KB, 655350 bytes
|
|
MD5:
ec9071bce8432fa5448685e430bc4747
SHA1:
a2666cf9ba4ce5ba61289adec0647f15c9c90a99
File Size:
1.05 MB, 1054616 bytes
|
|
MD5:
4638d656d3ba0021bf11578770d9dfe1
SHA1:
dfeaf7978e1667d8af8041cde8e6b68e95b51ecc
File Size:
81.66 KB, 81661 bytes
|
|
MD5:
a4a18451a03947e37c23b8e767fd6bbb
SHA1:
43f196a04e139dbd0af0dff2e7f2fd7617089069
File Size:
2.20 MB, 2196712 bytes
|
|
MD5:
4e9b0c3fc5f71cc8de3ba3a414d9772d
SHA1:
dd09f18345b8efacc7f271cf33fed7353a5d01a5
File Size:
8.45 MB, 8452080 bytes
|
|
MD5:
f752255e15ed8cf7f8d4ab3accb4832c
SHA1:
57325cc5b54b7936f7d6cfccb68a8cd3fe3e8ded
File Size:
787.78 KB, 787776 bytes
|
|
MD5:
cd739b71640948de8c5e87173f83a87c
SHA1:
25faa3e6a7943d9972464c87e0eae6f9f3da27c3
SHA256:
A8634D4914775C9EF58D5F4A42DDC67DF5F76FAE28375AF2BDCC25C14F776616
File Size:
1.58 MB, 1581352 bytes
|
|
MD5:
da62b46db2594e3d10de2f325d668787
SHA1:
c27e708afbc706ca03911d09263269afb48ff07b
SHA256:
C999DF9BBA9F3F9A8A2299CFF3F86D1D5D6200D4A0A9930C036E604796C48035
File Size:
538.98 KB, 538975 bytes
|
|
MD5:
13272279fee62f9d99a503a739e77368
SHA1:
6c44d1da54bfab5007fd5ca616c5b356e81e190c
SHA256:
9815FAC60743B8AB4D42DC9A431166E0292A04A86D667B6E303086C366025898
File Size:
1.04 MB, 1044480 bytes
|
|
MD5:
72c903af0401d3e9d309d772b1709a6c
SHA1:
99b80926d84b680b16c46feba2d47905e9fe2b2d
SHA256:
1584FC2804F1621969F2605E27900F9831F5DA9749335D4A8035AF85ECEE6F9F
File Size:
308.31 KB, 308314 bytes
|
|
MD5:
ec361815b1f715a8a8dcd35be6933b10
SHA1:
678bf3e8f2ddd349f41d1bc44818769049a1bb7a
SHA256:
75CB286900C2362961F3395A09B9686B8A71EDB20EA79CE20D6BC9237C9879B6
File Size:
982.14 KB, 982144 bytes
|
|
MD5:
97c1932fee5aa71efae801401b74567e
SHA1:
c649d41de66c4491e3864db15f80edb91703fea0
SHA256:
F33666B993C7C7AACBDD2900C8B5A9BB1B206C43724F78A0D69E8FDB9BEBB47A
File Size:
372.03 KB, 372032 bytes
|
|
MD5:
361ce750a170da1aee2be20a9a539921
SHA1:
b5cfcea787077833e13aeb6a030d4abf50e9d59b
SHA256:
5CD839AC4CE461EACC7A4C24B90FA805DC919949843E8FDEF09DDAE521DA5089
File Size:
524.28 KB, 524280 bytes
|
|
MD5:
48e1dffcbc9524a8d16295149878bde3
SHA1:
11ddd2bee405520ca43c54d01434ff0411f8b751
SHA256:
EB8DD33A119CF83748DA14BDD04C3924338C3FCB3B82A42D06E9321C1547935D
File Size:
2.46 MB, 2462720 bytes
|
|
MD5:
00d7413b8c05708a8ed7f79f9c23fade
SHA1:
46b45f3f45c2ed5c4b974b86410cc9fe23026e3a
SHA256:
C9B7A3540DB4724FDEBE5B7B5F212941238F68B3BD105AFCD3932128B2EE4CB2
File Size:
838.51 KB, 838512 bytes
|
|
MD5:
114b7aced0f7eb334bd979019afa2cf3
SHA1:
66cabd12f20226fc81c0a028eb8f2e81bf7a7d99
SHA256:
F90CB34B163E6FD230426748585679A45D3631C2136E9AB766595E93EC262AD7
File Size:
291.64 KB, 291636 bytes
|
|
MD5:
331fe40db27522b9ce507f9da1e71a24
SHA1:
60f93f0b00685274dbb45f4cd1ad7d4a6b43ee12
SHA256:
A4D3C0475A809CBBBDF8FD96BBBBF0955F498C4A2A2097D11C340CF1C7586C67
File Size:
93.96 KB, 93957 bytes
|
|
MD5:
fbf0e2a9f776cc20d74d2d91f2016371
SHA1:
493dae65242a45b922e3c7c03c7147989d18256d
SHA256:
C44D37F2BAA56B6C4E05D8568226B776843E213FFCD7A81308C3D17DF4673D15
File Size:
1.25 MB, 1254264 bytes
|
|
MD5:
6ae98df42752f76e710310d1966e8dcc
SHA1:
74375fe85f2fbd0675ede67897ea8a25f18e9db8
SHA256:
72B5A91B146D43AA10BB5FF5061A82C2416D141FF16308ED35C595A946E714B8
File Size:
6.70 MB, 6701616 bytes
|
|
MD5:
4e6f5b9eb7288a30930602c5098984a7
SHA1:
0ec76a16de796fbaa12f122e6dc8fda4a01e638c
SHA256:
CCFAAE4BFF89F3C32C2FC8C2E6D984A7880ACA591E8857BC4937B54B24D9F4EF
File Size:
54.69 KB, 54687 bytes
|
|
MD5:
89c3c7a318216fb048ae099142580a33
SHA1:
284af90d6d98c693c5e18bf8b51d8745de3c6019
SHA256:
03E0207A9F426313ACBFFBD9A0F1C51C41F9AC63DABF2F1DFA5606E3E6AB125F
File Size:
2.60 MB, 2599152 bytes
|
|
MD5:
080d3b020bd0eb35094215eb175c5a02
SHA1:
d1ee45cf2c764a939a4dc4900fc2cb428d781afd
SHA256:
4D4BE45D42FA6991F2EF5AD9EC923521AC596261E8297385CAB9E3B7010E6B05
File Size:
453.94 KB, 453936 bytes
|
|
MD5:
af8542a3445605e46a059a7d2da6fea1
SHA1:
1bc44dc7ab869610a02e8ca323827115e7bcd7d1
SHA256:
8560C1D780EAC56408956531FE93B63F4DFE31F064B60FAA521F1015A7AAC209
File Size:
286.61 KB, 286609 bytes
|
|
MD5:
7cccc8809becd197708458d10a140e2f
SHA1:
04040d1efa10be06c963d35614a477f18cdbbae4
SHA256:
40B8F17C10AB281911C42BACD72D7222EEBDFE929F48A96700AD55E2DB9B494B
File Size:
412.56 KB, 412556 bytes
|
|
MD5:
d30d950e03dfce642026dbb011728bb9
SHA1:
928b8bc6ee29163a75e4eff313964d4f02c80ad4
SHA256:
90602E556D188020A74EA6C22B84954D96FD6C21DC7C4D2E78485545AD6CFA72
File Size:
132.32 KB, 132318 bytes
|
|
MD5:
e40f938ff957cf36006057f246961464
SHA1:
e9044731e95d4a4c00e9a7bf44ea60a48d4870dd
SHA256:
FBA57C968E1493E5F2CE935240376C1918313DFF6C21439FE937389D16593535
File Size:
3.86 MB, 3861552 bytes
|
|
MD5:
92d72d302fc65fed19df603b3d76e394
SHA1:
aea01e20529338af60b7ff45f56a25aafc4de113
SHA256:
7939367B33C712D5A8B42B4CC7D5DF299D50AA8B1038CB1F0BA819184CB1E084
File Size:
2.62 MB, 2624077 bytes
|
|
MD5:
a70134788641ce3800304922762ada52
SHA1:
d90ef0024991ef9fb030bea45bd2d9391f7d9f91
SHA256:
91BB769C1165ED08EDD50D0E694291AF9E00008522F07807CF1E4E9CBCAA34BD
File Size:
651.26 KB, 651264 bytes
|
|
MD5:
213ca4a49372557565b3f52f8dc71141
SHA1:
757ca1ef654ce14f2b61dfce1d114c7e2f63cb22
SHA256:
B6383A3D9525DE4D16F7DA3CB6E51FC28C75B244F51773AA7AB7E5A91217CAB1
File Size:
175.79 KB, 175793 bytes
|
|
MD5:
a51414eac93b9859f9aafc97d63cbd18
SHA1:
4eec8a237b6164f2cd0ab47ff1bf23088c8cafc7
SHA256:
EAB6CBFDFD1E81D775237FC67221DD7390E59D381772F73206872F1453090C4E
File Size:
176.68 KB, 176676 bytes
|
|
MD5:
3ef358bbaf83c26b95da1032fd620afd
SHA1:
7dae31a7e14d4b543468e985b389233fe1bc5e24
SHA256:
7638B45A1D531B90595D20B7C772B35355C7600ED7CDF801B212368D8EFF1B02
File Size:
412.61 KB, 412605 bytes
|
|
MD5:
db85f30622274a644d3a2ed5b7803538
SHA1:
269410cf659a45a3a106d8cafdc4dc5e8be20759
SHA256:
94A28C9EB4A731AB618D30C5A660C43501BB92E15C1ABA1EE0D5EB496396B658
File Size:
70.66 KB, 70657 bytes
|
|
MD5:
de553f2bffb8549d6aaa0c50d274d05a
SHA1:
6276eaf849e7c73bcf9d5d63c3f9567bc757bc86
SHA256:
34E3A38B4D698FFF5B7177052DE783875DB685F1763AF5DABDD7751D5E9B00E6
File Size:
311.50 KB, 311503 bytes
|
|
MD5:
c1fd04098c3c5c0f29b719d3b2dd53cb
SHA1:
ea1c72a9efa0f1449940b8c410e261052bdbc277
SHA256:
D1F123B5364C899B2049B958F874560EEFD3558730ED589952D7B1869CD9B47F
File Size:
372.01 KB, 372008 bytes
|
|
MD5:
45499d65cb10ccc3855033bab303e42e
SHA1:
a713360a04ef3d21903b659c9b27c39e04c44e7e
SHA256:
0CA88A1ED4FEBDB58E3CAA111B60FE0FD87D3F282B5502C16A9B534B3D247CAB
File Size:
380.95 KB, 380949 bytes
|
|
MD5:
5ab8e29676e8b9846158be48568f20c3
SHA1:
fc669fca7bec5de5e74760385fbfc53dc9d6cdbb
SHA256:
6F97F1283898F08371C14ADD097BDD5637F1B1B88369846819118E8251BDD8EF
File Size:
813.35 KB, 813346 bytes
|
|
MD5:
f455be6c921d79d8accab17e2cae155b
SHA1:
6f4ff4cd8406b6768756400dfa1dcb2c67733169
SHA256:
F641105F4B8264D45F4B0603013AC961762DA347CDD2BEEE31EE1B4934C1F29D
File Size:
5.24 MB, 5244472 bytes
|
|
MD5:
07b1a7162fe91929dc34d266e8e773ed
SHA1:
e2bf700fbeb6701bd5d11f863a21074a1160fc25
SHA256:
ED023587AD5987810CDB04415240DB684D85086ECECA0DD15AAB909CFF8ADFC5
File Size:
5.75 MB, 5745512 bytes
|
|
MD5:
c175557e7c7c688bf1b85881cb23823e
SHA1:
ca2c97274ada765d775862fbd89862679ecd07cc
SHA256:
D2B254075A2E4950591862CBF3707ED3A99425AD86D438B6F0F57339B6413F42
File Size:
5.31 MB, 5314728 bytes
|
|
MD5:
9e8e36392e6abeec06ecd0ba77a40002
SHA1:
c84a1a8616bdb09c998ca317fa074f8bac167206
SHA256:
3BB244F67633C9FDEB7626CA81F8CBB13C4405C5F264BC7582AB0B6342379CEC
File Size:
7.54 MB, 7541752 bytes
|
|
MD5:
18b3b186e38c741aba1d4aea259b8832
SHA1:
7fc5597d1708d49b7e3e4586bf3da96f94f9f17e
SHA256:
706D2EA127DFCCBCCB124A6DCD7D4DB78BA700B39149752BAB87EADC5B130EBF
File Size:
1.18 MB, 1179630 bytes
|
|
MD5:
eb714f9c9975c9d9719b35fc6f546bd8
SHA1:
c313e911bb748d69959c3f73b7cbc66e9a709c68
SHA256:
6860BAA9D2724A5B795A3D72BB28AD860297ED1B093ECBF237B287FD70665027
File Size:
634.20 KB, 634200 bytes
|
|
MD5:
b4315e5ed9c3e54d61b5ac525a5eaed7
SHA1:
ad4896a8132547ce570799747e45f0ff4e93a59a
SHA256:
17D271F2CFC77325AE21DB3A69A0A59BB8D6A454F5E03F2CDFB1598F623AEDBC
File Size:
381.97 KB, 381969 bytes
|
|
MD5:
7e8f5b509a7ac2a9ffc7222d6952ecac
SHA1:
5b66383271f64958efb7bdb17c7e1a95ac5cdd29
SHA256:
E6C7C0E88D4EB87B649F5F29D420DE9A73BCC6C1516ED930BE1ABDA61836B3AC
File Size:
1.23 MB, 1228984 bytes
|
|
MD5:
e9f6c4dec97a125f81c660b2c866e02e
SHA1:
fb8e0f1f0d381bffadb64ee7dd23c27bb88438a9
SHA256:
E92469BD4860784FA2C7C1EBCF9064A913AF3A3B511D1152BC611BBA3DF6B7C8
File Size:
124.13 KB, 124126 bytes
|
|
MD5:
44942199ff2d89326ce1a56742bbe09f
SHA1:
57df95eefc46b7f750bb6743221cb29cd6426645
SHA256:
2F870FB7AAA1DB42899B2881BE7A30C62F8DAB3BA60A7A128F95C5CBF1409A12
File Size:
263.21 KB, 263208 bytes
|
|
MD5:
4cae80c540a93d1b88739e15c98a6074
SHA1:
a5eb4fa6360f0aac7359c0d8c95b772c065802d2
SHA256:
B9ABA135678EA75B6B36274A8DDB5D8AA55F288D54FFA72715649333545B003B
File Size:
1.31 MB, 1310146 bytes
|
|
MD5:
fd8e0a769d8175ec4ff89d0e8fad5385
SHA1:
4f69140f7735aa2d3b7647c879eb49265732c7c7
SHA256:
268992A6B4216DE752ED5C0A7C5BFF6ABE03A481C94CE29AD170C475DBB52556
File Size:
212.99 KB, 212986 bytes
|
|
MD5:
6184fbd7146ef75f834812151148dcda
SHA1:
03db93c68750cc46c973d31879b72128ae4eefd1
SHA256:
5DBA22A033F995D4CC73619D16D7F4BF285B9B91DE03D81A3C59DF0676F295F5
File Size:
172.18 KB, 172184 bytes
|
|
MD5:
7b188e8827c9400995228a24ad8ce7d4
SHA1:
1ee3798091a0aa5c020a9f0df45a94df4f166534
SHA256:
50597E9EB01B312B24764CFEF1E647F81AC2095574C57576521B413AAAEF1526
File Size:
68.96 KB, 68962 bytes
|
|
MD5:
55281f0fe8d304f4ace01679aabf3252
SHA1:
2754f839fa149a2f78780a8a6f2f4e5bf4382c8c
SHA256:
9C74457413AD58209AF0252A9B2EB075492738BF57C9A0C19FB7F8EF70E6082A
File Size:
776.76 KB, 776760 bytes
|
|
MD5:
014d4940b99041ecf7d80a8420032dc0
SHA1:
3ac5b34fac6ed87ba76673020cfb6d1dba3b6509
SHA256:
550A12CB6FC096294D1480975D8A96B67DDFB5217D2D32D6E2B862F03C601878
File Size:
443.37 KB, 443371 bytes
|
|
MD5:
6c6d27437c5fe8249e1dc3080af66165
SHA1:
df7d3e6fff8baac3892a9253c2953e9649b24a83
SHA256:
657271E3711209A01BF825E66902981DB38B9B7157B727DD9A5C9C0038F0DE8F
File Size:
773.22 KB, 773224 bytes
|
|
MD5:
adc2c483163bf61a3ea6bb9f3e21c89a
SHA1:
e3b96da1f579a52879415dfad43be7fbf0fb4bfb
SHA256:
A43CEDC11ADBF95C05E08AC5096D1CD2707D0AA686CB5DF99F4D16F35EC5FFF8
File Size:
454.66 KB, 454656 bytes
|
|
MD5:
fef17e1a443214d6eee5d736e41fd02d
SHA1:
e257fb8d2537930e292a28321c9742e9dff48910
SHA256:
AEA5FFD8C2963AC807E4E2633A95145A968116C879F821D70949F0A7472796A8
File Size:
4.40 MB, 4402176 bytes
|
|
MD5:
efd7c8ed1d389a41650799664bb54706
SHA1:
d3c69ab546f66694d5a62c7a7e44067cd99783f7
SHA256:
8653CFE5E485F5C25BDEEBE114F3003E9179341FC71A5CAD16FC727C156330A2
File Size:
493.88 KB, 493883 bytes
|
|
MD5:
60d2f115b81118a1849a55df95a285e3
SHA1:
39bf9800aa07641457426c17e1774da2c55eea0e
SHA256:
C4AACD71488E4EFB013D7ED2746688665440D465D4AF80DB4C06450D713433F1
File Size:
73.26 KB, 73263 bytes
|
|
MD5:
296a0a1e7d6d47030ccd1d482db4e206
SHA1:
4f4dc85dedd5467a0780437bc6663dbadd4d9a2e
SHA256:
A6C2D48329511AF819022BAF1AA63F4215BB6651E125EB8B214E753BF4232AE8
File Size:
776.30 KB, 776304 bytes
|
|
MD5:
6a5c5ce579a28da5cc8d2a2891266b1c
SHA1:
343861f19d96df0c7fb1b47a0cee2c007c1d45f0
SHA256:
1D3910868A9BDE6A2060F779696CD791A275AC11E0C211DD9A4B93984D52C1E2
File Size:
58.32 KB, 58318 bytes
|
|
MD5:
5c936d337a53d2c80d4a380de2928ce4
SHA1:
379cb9881444cace3d19914a3caebe8d50a87b55
SHA256:
B09482D1727E56E4970DE708B7ED4EBFAE3903D2DAFF3FC3727E7DB6D7AB31EF
File Size:
365.51 KB, 365510 bytes
|
|
MD5:
fff6f65f5e0885753d99b337e37a5344
SHA1:
058c3700b3cf35cb488faaf102131d103e832c56
SHA256:
265C13682AFB0CD76C9CA647D90BCA35CA3A50C6EBCE7C33233BCFB22B523D19
File Size:
173.59 KB, 173586 bytes
|
|
MD5:
93227749c050901647ee51d5d03fcfe3
SHA1:
f270fb2c7799aea59601f6e3202c4801c164a71b
SHA256:
E678627412B8BAD06EB504F5E9536FD59D0B37DEF18ED7AF73CB83363C2C85D0
File Size:
256.20 KB, 256200 bytes
|
|
MD5:
06f5ce2724a8b7857d3b284ac8503438
SHA1:
3d769e8d3aba579f5a08b6e85685abaae8569113
SHA256:
9FE4D4FA0652FE7D37175A5E866DD0EC2F446C9B1D92CA6EB88DFDAF04984A99
File Size:
403.38 KB, 403384 bytes
|
|
MD5:
50015d72ea8405d0241d0f9ddb87d487
SHA1:
950aac9e738ca7df5ae299bbb834ff1c90fc8b28
SHA256:
C48F6B7202BC17E460982E744309A62696A4E5E4AD81212392442B0F85D1F73E
File Size:
263.22 KB, 263216 bytes
|
|
MD5:
bebabb9ca6dbe323387cab78c1b602de
SHA1:
2c9e6c440632083319cf095514c0c663d045b848
SHA256:
60F00E3435D4C4D64B05DED7B6C5138050F5F8641F13B03132784E4A146E9E54
File Size:
177.22 KB, 177220 bytes
|
|
MD5:
0cfaddf983f40e81cd04459cd85e6b2c
SHA1:
b23c7f56b45b1bbeb46c01e09e77d813e50b67ac
SHA256:
CED9AE12ADA911FC1E0C293BC3DBC700F8D587BC4E6003D66C93D84CFB0CB319
File Size:
453.94 KB, 453936 bytes
|
|
MD5:
cdb95735daf7a563565efb9a6c6ee672
SHA1:
2180ee8999fc8031e91f96e0b9d01720e245e636
SHA256:
232D90B480F7D87E8A421959EC3640E707D51B94B978EA2A80924414AFF4B0E5
File Size:
795.15 KB, 795152 bytes
|
|
MD5:
1b1dd9336fe731d858093b0b51aa5d61
SHA1:
eb62a2ec5cbea2df8bc41ca645d3c74172cac091
SHA256:
5B09C1BAD6349322ACD5E85201B582791D409E388C0CD47B05739071F903E6C1
File Size:
1.00 MB, 1003920 bytes
|
|
MD5:
a7be15e093a6c709e15eae3dcff9a65a
SHA1:
48f9ae6a312a87f9591fa0428f5ffa4c17a62691
SHA256:
FB5D6B0E4F223E106C639E7D7E929C0269D267C8F6F274E9B535F0A0A400653D
File Size:
129.45 KB, 129446 bytes
|
|
MD5:
24bed1ba44edf8042705c65588a3685b
SHA1:
03ee87dd5f17c1be9234f232fb6d78bebc910257
SHA256:
4B32CE1B92CBDA0626E534BBE9370489753248813AD198EF3F0BFEFE2AB9CF2C
File Size:
179.90 KB, 179902 bytes
|
|
MD5:
b89164a44c6cb4e5d6d58d1098d07429
SHA1:
e8944ca88ac687330b52cc4e4182684a62b69cf4
SHA256:
E275931B6ABA5658A92DE2449E1FFFCA5E854D146AEF7B62BF40EF819AA76669
File Size:
285.09 KB, 285092 bytes
|
|
MD5:
7beeb7e7702e9d726e259f3a587d0db7
SHA1:
46df306e3f074aa0e603f6b9fd5989212493c716
SHA256:
1463B76CC161B41F8D0C39FB4B84CDF4A2D0CFBC0ABD240F4F4808D9EC82C9AA
File Size:
178.19 KB, 178188 bytes
|
|
MD5:
fe56bbf098833b6f098719bf12efbf23
SHA1:
bc0e324514a72086498ef337ecff1642c1841050
SHA256:
7A8020586BACF214E46380766A17C19DEE4AB8732EA2EA805F1BAFB308EA528D
File Size:
180.77 KB, 180770 bytes
|
|
MD5:
c5e259afd585767caea2c9ff3dcc6b02
SHA1:
809871c6cda48d444f03ed630cf9ceac7c387767
SHA256:
67836D66C0CD44052B6DC630DB3D5B56BB31CB89188C67D518234D651BA5A5C4
File Size:
773.10 KB, 773096 bytes
|
|
MD5:
c5843d8d4e5f464590b82e63abc28aa9
SHA1:
8d53260d4cbeb781cf849846966bebc448977b5e
SHA256:
C70FDFF0BC4A4028C10588DB0A10A29D9E41E92513FBC7B49FBAF5EC21E7AB04
File Size:
3.97 MB, 3967016 bytes
|
|
MD5:
bfd69ab1b7d9eacfab5045fe0794d3a1
SHA1:
fcfbed107c1ddf29efa93951e543bea640628988
SHA256:
7FB9CB5A14EA91B07572E842ECD9CFDFB8B9B299106D4BA525D83BB74D924EAE
File Size:
2.17 MB, 2173696 bytes
|
|
MD5:
ebe2252b499f5c50801f9222f779fc93
SHA1:
08ef6f894c3f77f1669d5089da54f7038de31ee5
SHA256:
8475EF0A4F3539AF3DB08B429C336AFA3C35D40D68298A3BE470089BC5600BE0
File Size:
6.64 MB, 6641880 bytes
|
|
MD5:
95521b1a7a7a801d6d991b4860ea1046
SHA1:
01b1844f0acbc4f97dbf01c3c531bdb420befd93
SHA256:
9A14AB08D24AAB729277EF0F7906E11444E79E0D221DC63BBEEFE233EDC8257D
File Size:
423.82 KB, 423816 bytes
|
|
MD5:
25afbcb2ca6f45bb3654074ea2e05237
SHA1:
a566a3ce42238ad457e238cf563b62c0e97c04b7
SHA256:
1E2D839124F85130A9C8A78267E45776871BA8EFD874C483267E8B312305E400
File Size:
443.37 KB, 443370 bytes
|
|
MD5:
07b0c8a466c9a6a4589e2ea87b9a2c44
SHA1:
9637cbb53d1c71650629f27650cfeae508a4453a
SHA256:
33E8C6A8BE48C3BA78E9F500255D58C0938FCE1D993C9A10F742C697423F829B
File Size:
3.96 MB, 3960936 bytes
|
|
MD5:
757f1c4314620af29c9d8cf7b62a0de7
SHA1:
503156625732ffe740e5d021b549d871b2e90dd0
SHA256:
B8C90C9A69A9A7314D9083AA2A6BE5222EECD0D14B1B6EFEDFF35A6C0B83E733
File Size:
169.73 KB, 169732 bytes
|
|
MD5:
943f3844d50415b979449b13ef79651e
SHA1:
15bc2f1f3a1d3874f323f6df8528cbfcfab91cf3
SHA256:
048524D21EB23AD5CBD809E7DADD09870BFFA001FBF3429443B2FF9D85556DB6
File Size:
372.03 KB, 372032 bytes
|
|
MD5:
2d03b645926fb2e9f1fbd612377eb3e8
SHA1:
1ecfd184c984e24954b51dd386576a67d4090f7c
SHA256:
63FBFEE8B4E2F61DAE1948315686C3BBD878CBD5AF754FA42C3338307D1A9928
File Size:
116.86 KB, 116864 bytes
|
|
MD5:
886901574f2e86487c0f3913aded6d45
SHA1:
6a86037c04a43bdbcee1d1bee8baa5e75bdce4fc
SHA256:
E5DB86720A9B51457A80729E96CB0114F52D316D311A69A0CC11D0D7283E45A6
File Size:
402.88 KB, 402879 bytes
|
|
MD5:
aab657102fed2124b4f9591a2acb8b64
SHA1:
35530b8cd2a2b8dfd8fd8eefdbfe81ccb5b9bb93
SHA256:
D1AD73332BDC13C0531807EDD0D4CFF7873F777BCD6ADB6A019CF0550612B08F
File Size:
423.79 KB, 423793 bytes
|
|
MD5:
ca139610ec762c377e72ab861bb7b36a
SHA1:
7fc9c884e0450cc68bcd2ca369ce16894bb02304
SHA256:
BD04076891D7A49D951F93B8BF0700D18393650B7B9037CCFF2FC76657B40654
File Size:
90.85 KB, 90847 bytes
|
|
MD5:
c268a50330d133cfb8f6a4c421b5b29e
SHA1:
22a251ea03b2f4f8a8f528a2d3175a8a9f83d045
SHA256:
09F1B9609BEB0339A6111E53354F2B1B160022E908771B8F03A67C214DEF996E
File Size:
397.69 KB, 397688 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
137 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
|
| License | GPL Version 2 |
| Original Filename | CloneSpy.exe |
| Product Name |
Show More
|
| Product Version |
Show More
|
| W W W | http:\\www.clonespy.com |
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| RonyaSoft | COMODO Code Signing CA 2 | Self Signed |
| RUSSKAYA TROIKA, OOO | COMODO RSA Certification Authority | Root Not Trusted |
| Certification Authority of WoSign | Certification Authority of WoSign | Self Signed |
| Bitsum LLC | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Hash Mismatch |
| DR. JOHANNES HEIDENHAIN GmbH | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
Show More
| ONTINET COM SL | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
| Cologne Code Company e.K. | DigiCert Trusted Root G4 | Root Not Trusted |
| ONTINET COM SL | DigiCert Trusted Root G4 | Root Not Trusted |
| 温州银行股份有限公司 | DigiCert Trusted Root G4 | Root Not Trusted |
| Fadeburene | Fadeburene | Self Signed |
| Garrisonian | Garrisonian | Self Signed |
| Hewlett Packard Enterprise Company | Sectigo Public Code Signing Root R46 | Root Not Trusted |
| Poikosoft | Symantec Class 3 SHA256 Code Signing CA | Self Signed |
| WildTangent Inc | Thawte Code Signing CA | Self Signed |
| WildTangent Inc | Thawte Code Signing CA - G2 | Self Signed |
| WildTangent Inc | Thawte Premium Server CA | Root Not Trusted |
| Udpining | Udpining | Self Signed |
| China UnionPay Co., Ltd | VeriSign Class 3 Code Signing 2010 CA | Self Signed |
| Poikosoft | VeriSign Class 3 Code Signing 2010 CA | Self Signed |
| 北京微通新成网络科技有限公司 | VeriSign Class 3 Code Signing 2010 CA | Self Signed |
| WildTangent Inc | thawte Primary Root CA | Root Not Trusted |
| WildTangent Inc | thawte SHA256 Code Signing CA - G2 | Self Signed |
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.M
- Agent.MH
- Agent.MI
- Agent.MU
- Brute.BH
Show More
- Brute.BHA
- Chapak.HBBB
- Chapak.HBW
- Chapak.HBX
- CobaltStrike.GI
- CobaltStrike.GIA
- FakeAV.AU
- MSILZilla.TC
- Makoob.A
- Parite.F
- Rozena.H
- Rozena.XC
- Trojan.Agent.Gen.VN
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe | Generic Read,Write Attributes |
| \device\namedpipe | Generic Write,Read Attributes |
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| \device\namedpipe\pshost.134071055262448484.5372.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| c:\paradoksalitet\savourless.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\program files (x86)\common files\contraernes.exe | Synchronize,Write Attributes |
| c:\program files (x86)\common files\opportunely\smaaliges.htm | Synchronize,Write Attributes |
| c:\program files\aruba networks\aruba onboard\install.log | Generic Write,Read Attributes |
| c:\programdata\{aab25d12-d27c-489e-9095-cb1a2681e03e}.lock | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\microsoft\windows\inetcache\fokusets\temperaturstrukturfunktioner.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\microsoft\windows\inetcache\triste\maldivian.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\craterkin.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\aritmetikker.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\diagnosticeringernes.alf | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\envoys.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\glochidium85.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\hexaped.mis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\lsepulten.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\mobship91.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\nyhedsystems.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\partielle65.for | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\reavow\prothmia.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\reavow\teosintes.gam | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\reavow\tilbagedater.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\reavow\udsendingen.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\scapulodynia.cau | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\precontrivance\violinistens.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\pollent\resterilise.top | Generic Write,Read Attributes |
| c:\users\user\appdata\local\reeducative\hampegarner\srver.kno | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\26430\sunday.pif | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\26430\sunday.pif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\26430\v | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_2qv2iafj.nsk.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_gaavbwcs.egr.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\acid | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\acid.bat | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\b | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\gardens | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\glasses | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\gorgeous | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa3abe.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsa647c.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsa647c.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsa647c.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsaf75e.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsaf75e.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsaf75e.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsaf75e.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsaf75e.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsb31c6.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsb7aaf.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsba573.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb0d5.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsbb172.tmp\css\progressbar.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\css\style.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_de.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_en-us.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_es-es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_fr.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_it.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_ko.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_pt.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_zh-chs.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\eula_zh-cht.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\images\downloader_bg_400.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\images\processing.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\images\progress_blank.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\images\progress_frame.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\images\progress_green.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\install.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\js\install.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\js\strings.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\packardbell.ico | Generic Read,Write Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\packardbell.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbb172.tmp\wt_plugin.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsbbfe3.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsc2388.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc2388.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc2388.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc292e.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc5248.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsc71e0.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc7d2.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc7d2.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsc7d2.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc7d2.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc9dd9.tmp\a14638759ce195a0cf63e07f7a5545c97a69fab4_0001023832.exe | Synchronize,Write Data |
| c:\users\user\appdata\local\temp\nsc9dd9.tmp\park.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc9dd9.tmp\setup2.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsc9dd9.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\acer.ico | Generic Read,Write Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\acer.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\css\progressbar.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\css\style.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_de.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_en-us.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_es-es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_fr.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_it.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_ko.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_pt.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_zh-chs.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\eula_zh-cht.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\images\downloader_bg_400.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\images\processing.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\images\progress_blank.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\images\progress_frame.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\images\progress_green.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\install.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\js\install.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\js\strings.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsca881.tmp\wt_plugin.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd45ef.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\advsplash.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\campo.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\campos.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\campos.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\ipconfig.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\nsiscrypt.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\splash.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\splash.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsd4f3.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd7df3.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\killer.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\killprocdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\nsexec.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsd985d.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsdc095.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsdc095.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse2c59.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse8272.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsead62.tmp\langdll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\advsplash.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\background_small.ole | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\button.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\campo.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\campos.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\nsebf64.tmp\campos.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\graphicalinstaller.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\ipconfig.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\nsiscrypt.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\splash.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\splash.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsebf64.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsg69a8.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\css\progressbar.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\css\style.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_de.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_en-us.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_es-es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_fr.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_it.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_ko.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_pt.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_zh-chs.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\eula_zh-cht.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\images\downloader_bg_400.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\images\processing.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\images\progress_blank.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\images\progress_frame.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\images\progress_green.jpg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\install.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\js\install.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\js\strings.js | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\toshiba.ico | Generic Read,Write Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\toshiba.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\userinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga45b.tmp\wt_plugin.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga4a8.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga4a8.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga4a8.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsga4a8.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsga4a8.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgbd7a.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsgbdc8.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgbe64.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsgbe64.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgbe64.tmp\system.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\css\progressbar.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\css\style.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_de.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_en-us.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_es-es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_es.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_fr.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_it.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_ko.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsgc09f.tmp\eula_pt.html | Generic Write,Read Attributes |
410 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\eset\eset security\currentversion\info::languageid | ఊ | RegNtPreCreateKey |
| HKLM\software\eset\eset security\currentversion\info::productversion | 1 | RegNtPreCreateKey |
| HKLM\software\eset\eset security\currentversion\info::producttype | eav | RegNtPreCreateKey |
| HKLM\software\wow6432node\eset\eset security\currentversion\info::languageid | ఊ | RegNtPreCreateKey |
| HKLM\software\wow6432node\eset\eset security\currentversion\info::productversion | 1 | RegNtPreCreateKey |
| HKLM\software\wow6432node\eset\eset security\currentversion\info::producttype | eav | RegNtPreCreateKey |
| HKLM\software\eset\eset security\currentversion\plugins\01000400\settings::activatetrial | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\{70b446d1-e03b-4ab0-9b3c-0832142c9aa8}.wildtangent games app-temporary::uninstallstring | "Uninstall.exe" | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qrmuayew\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Qrmuayew\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Qrmuayew\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\wildtangent\installerstatus::install | 0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\wildtangent\installerstatus::download | 0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jmqgalcr\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Jmqgalcr\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Jmqgalcr\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\classes\appid\{de4b4456-8e75-42bc-a6b8-0a09c59fcf78}:: | PassGuardCtrl | RegNtPreCreateKey |
| HKLM\software\classes\appid\passguardctrl.dll::appid | {DE4B4456-8E75-42BC-A6B8-0A09C59FCF78} | RegNtPreCreateKey |
| HKLM\software\classes\nxypassguardx.passguard.1:: | NXYPassGuardX Class | RegNtPreCreateKey |
| HKLM\software\classes\nxypassguardx.passguard.1\clsid:: | {A4B446E3-7423-41CE-B210-854317CE9889} | RegNtPreCreateKey |
| HKLM\software\classes\nxypassguardx.passguard:: | NXYPassGuardX Class | RegNtPreCreateKey |
| HKLM\software\classes\nxypassguardx.passguard\clsid:: | {A4B446E3-7423-41CE-B210-854317CE9889} | RegNtPreCreateKey |
| HKLM\software\classes\nxypassguardx.passguard\curver:: | NXYPassGuardX.PassGuard.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}:: | NXYPassGuardX Class | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\progid:: | NXYPassGuardX.PassGuard.1 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\versionindependentprogid:: | NXYPassGuardX.PassGuard | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\inprocserver32:: | C:\WINDOWS\SysWow64\NXYPassGuardX\NXYPassGuardX.dll | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\inprocserver32::threadingmodel | Apartment | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}::appid | {DE4B4456-8E75-42BC-A6B8-0A09C59FCF78} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\toolboxbitmap32:: | C:\WINDOWS\SysWow64\NXYPassGuardX\NXYPassGuardX.dll, 102 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\miscstatus:: | 0 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\miscstatus\1:: | s | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\version:: | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{e44810de-7158-4e63-86f3-e02fdaa4163e}\1.0:: | PassGuardCtrl 1.0 Type Library | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{e44810de-7158-4e63-86f3-e02fdaa4163e}\1.0\flags:: | 0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{e44810de-7158-4e63-86f3-e02fdaa4163e}\1.0\0\win32:: | C:\WINDOWS\SysWow64\NXYPassGuardX\NXYPassGuardX.dll | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{e44810de-7158-4e63-86f3-e02fdaa4163e}\1.0\helpdir:: | C:\WINDOWS\system32\NXYPassGuardX | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}:: | _IPassGuardEvents | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\proxystubclsid32:: | {00020420-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}:: | _IPassGuardEvents | RegNtPreCreateKey |
| HKLM\software\classes\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\proxystubclsid32:: | {00020420-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{4ee6989c-09a5-4f8b-8be9-e46ca4555be5}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}:: | IPassGuard | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}:: | IPassGuard | RegNtPreCreateKey |
| HKLM\software\classes\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{e2df5387-28f5-4685-bb69-1fb41a7bac3d}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\wow6432node\mozillaplugins\@microdone.cn/npsxnxpassguardx::description | PassGuard plugin | RegNtPreCreateKey |
| HKLM\software\wow6432node\mozillaplugins\@microdone.cn/npsxnxpassguardx::path | C:\WINDOWS\system32\NXYPassGuardX\npNXYPassGuardX.dll | RegNtPreCreateKey |
| HKLM\software\wow6432node\mozillaplugins\@microdone.cn/npsxnxpassguardx::productname | PassGuard | RegNtPreCreateKey |
| HKLM\software\wow6432node\mozillaplugins\@microdone.cn/npsxnxpassguardx::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}:: | NXYPassGuardX Class | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\progid:: | NXYPassGuardX.PassGuard.1 | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\versionindependentprogid:: | NXYPassGuardX.PassGuard | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\inprocserver32:: | C:\WINDOWS\system32\NXYPassGuardX\NXYPassGuardX.dll | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\inprocserver32::threadingmodel | Apartment | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}::appid | {DE4B4456-8E75-42BC-A6B8-0A09C59FCF78} | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\toolboxbitmap32:: | C:\WINDOWS\system32\NXYPassGuardX\NXYPassGuardX.dll, 102 | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\miscstatus:: | 0 | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\miscstatus\1:: | s | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\typelib:: | {E44810DE-7158-4E63-86F3-E02FDAA4163E} | RegNtPreCreateKey |
| HKLM\software\classes\clsid\{a4b446e3-7423-41ce-b210-854317ce9889}\version:: | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{e44810de-7158-4e63-86f3-e02fdaa4163e}\1.0\0\win32:: | C:\WINDOWS\system32\NXYPassGuardX\NXYPassGuardX.dll | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abmpufaw\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Abmpufaw\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Abmpufaw\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dfyblwpz\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Dfyblwpz\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Dfyblwpz\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Tdtetxrx\AppData\Local\Temp\nsp4389.tmp\ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\park.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\park.exe \??\C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Frwspmqq\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Frwspmqq\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Frwspmqq\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Frwspmqq\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Frwspmqq\AppData\Local\Temp\~nsu.tmp \??\C:\Users\Frwsp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Sbobzfkw\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Sbobzfkw\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Sbobzfkw\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Hfkgdswx\AppData\Local\Temp\nso602E.tmp\ | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\vopackage::isnw | 7 | RegNtPreCreateKey |
| HKLM\software\wow6432node\microsoft\windows\currentversion\uninstall\aspackage::isnw | 7 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Wpvukqau\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Wpvukqau\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Wpvukqau\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cfbrfxtn\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Cfbrfxtn\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Cfbrfxtn\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Oquzcxsn\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Oquzcxsn\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Oquzcxsn\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Futacrmm\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Futacrmm\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Futacrmm\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Gagjjhdr\AppData\Local\Temp\nsa647C.tmp\ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pxezadya\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Pxezadya\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Pxezadya\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 牏រ僪ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Xwyeqvpn\AppData\Local\Temp\~nsu.tmp\Au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Xwyeqvpn\AppData\Local\Temp\~nsu.tmp\Au_.exe \??\C:\Users\Xwyeqvpn\AppData\Local\Temp\~nsu.tmp | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\77e37ce0-8214-4414-aced-551c5ae204d7.tmp \??\C:\Windows\SystemTemp\e28eadcf-6ab0-4d8c-8821-7ce9a6aba1 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Windows\SystemTemp\a9dd6c3f-d641-4292-855a-e9c09c1b694b.tmp \??\C:\Windows\SystemTemp\85968c61-a19d-4e7b-a80f-d2a1fc3c08 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\112216\7640\c\users\user\appdata\local\temp\~nsu.tmp\au_.exe | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\sandbox_live\tmp\112216\7640\c\users\user\appdata\local\temp\~nsu.tmp\au_.exe *1\??\C:\sandbox_live\tmp\112216\7640\c\ | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\software\wow6432node\wildtangent\testregaccess::jkladmintestjkl | 1Y | RegNtPreCreateKey |
| HKCU\hjernetruste\uninstall\dissuasively\almenvels::polyorchidism | RegNtPreCreateKey | |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1f4c31ab-e376-4464-9d40-1d45fb451050}\1.0:: | WTTouchpointPluginLib | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1f4c31ab-e376-4464-9d40-1d45fb451050}\1.0\flags:: | 0 | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1f4c31ab-e376-4464-9d40-1d45fb451050}\1.0\0\win32:: | C:\Users\Tgkvtqcp\AppData\Local\Temp\nsgC09F.tmp\WT_TouchpointPlugin.dll | RegNtPreCreateKey |
| HKLM\software\classes\typelib\{1f4c31ab-e376-4464-9d40-1d45fb451050}\1.0\helpdir:: | C:\Users\Tgkvtqcp\AppData\Local\Temp\nsgC09F.tmp | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}:: | IHTMLExternalInterface | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\typelib:: | {1F4C31AB-E376-4464-9D40-1D45FB451050} | RegNtPreCreateKey |
| HKLM\software\classes\wow6432node\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\software\classes\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}:: | IHTMLExternalInterface | RegNtPreCreateKey |
| HKLM\software\classes\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\proxystubclsid32:: | {00020424-0000-0000-C000-000000000046} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\typelib:: | {1F4C31AB-E376-4464-9D40-1D45FB451050} | RegNtPreCreateKey |
| HKLM\software\classes\interface\{fc61cf3a-a858-415f-852c-e1373ad1cf0e}\typelib::version | 1.0 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ꌒ並볏ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Network Wininet |
|
| Service Control |
|
| Syscall Use |
Show More
78 additional items are not displayed above. |
| Keyboard Access |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Icmp |
|
| Process Terminate |
|
| Other Suspicious |
|
| Encryption Used |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Bfuatulo\AppData\Local\Temp\nsc9DD9.tmp\Park.exe" /EventTerminate "Global\WTPARKTERM" /SignalTerminate
|
"C:\Users\Qrmuayew\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Jmqgalcr\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\WINDOWS\system32\NXYPassGuardX\NXYPassGuardX.exe" "-s"
|
"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\NXYPassGuardX\NXYPassGuardX.dll"
|
Show More
"C:\Users\Abmpufaw\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Dfyblwpz\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\
|
"C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\Park.exe" /EventTerminate "Global\WTPARKTERM" /SignalTerminate
|
open C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\Park.exe /Execute "C:\Program Files (x86)\WildTangent Games\App\GameConsole-wt.exe" /LaunchParams "/src installer /dp samsung " /EventTerminate "Global\WTPARKTERM" /EventExecute "Global\WTPARKEXEC"
|
open C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\493dae65242a45b922e3c7c03c7147989d18256d_0001254264".exe /park="C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\Park.exe"
|
open C:\Users\Nvhxrkaj\AppData\Local\Temp\nsi6CF.tmp\Park.exe /EventTerminate "Global\WTPARKTERM" /SignalTerminate
|
open cmd /k move Acid Acid.bat & Acid.bat & exit
|
WriteConsole: 1 file(s
|
WriteConsole:
|
WriteConsole: C:\Users\Aiprqkg
|
WriteConsole: Set
|
WriteConsole: xTYOEJbvHciUkpq
|
WriteConsole: HITerminal
|
WriteConsole: Concert Payable
|
WriteConsole: 'HITerminal' is
|
WriteConsole: IpVirgin
|
WriteConsole: Grade Relocatio
|
WriteConsole: 'IpVirgin' is no
|
WriteConsole: BcJTracker
|
WriteConsole: Adams Underlyin
|
WriteConsole: 'BcJTracker' is
|
WriteConsole: MocfJury
|
WriteConsole: Jeans Chemical
|
WriteConsole: 'MocfJury' is no
|
WriteConsole: xbfMens
|
WriteConsole: Continuously En
|
WriteConsole: 'xbfMens' is not
|
WriteConsole: giConsiders
|
WriteConsole:
|
WriteConsole: 'giConsiders' is
|
WriteConsole: MQoPrisoners
|
WriteConsole: Supplies Somers
|
WriteConsole: 'MQoPrisoners' i
|
WriteConsole: kwGMKnowing
|
WriteConsole: Shoulder Envelo
|
WriteConsole: 'kwGMKnowing' is
|
WriteConsole: UsCnExplicitly
|
WriteConsole: 'UsCnExplicitly'
|
WriteConsole: rNWonderful
|
WriteConsole: Rounds Fabulous
|
WriteConsole: 'rNWonderful' is
|
WriteConsole: XkktxiCvIgUiusP
|
WriteConsole: lWExcerpt
|
WriteConsole: Connectivity Be
|
WriteConsole: 'lWExcerpt' is n
|
WriteConsole: ncksBrussels
|
WriteConsole: Codes Searched
|
WriteConsole: 'ncksBrussels' i
|
WriteConsole: HRvbMinds
|
WriteConsole: Cart Compiled
|
WriteConsole: 'HRvbMinds' is n
|
WriteConsole: JkGHWord
|
WriteConsole: Stick Exposure
|
WriteConsole: 'JkGHWord' is no
|
WriteConsole: WAGraphic
|
WriteConsole: An Correspondin
|
WriteConsole: 'WAGraphic' is n
|
WriteConsole: NmMedium
|
WriteConsole: Deviant Test En
|
WriteConsole: 'NmMedium' is no
|
WriteConsole: skPenalties
|
WriteConsole: Recommendations
|
WriteConsole: 'skPenalties' is
|
WriteConsole: kaHTbXHJKsOrjav
|
WriteConsole: SVyjSouth
|
WriteConsole: Telling Touring
|
WriteConsole: 'SVyjSouth' is n
|
WriteConsole: sxOptimum
|
WriteConsole: Portugal Sri
|
WriteConsole: 'sxOptimum' is n
|
WriteConsole: VbPJoel
|
WriteConsole: 'VbPJoel' is not
|
WriteConsole: oMzyCarrier
|
WriteConsole: 'oMzyCarrier' is
|
WriteConsole: HfChrome
|
WriteConsole: Similarly Start
|
WriteConsole: 'HfChrome' is no
|
WriteConsole: slfZSlope
|
WriteConsole: Paris Missing B
|
WriteConsole: 'slfZSlope' is n
|
WriteConsole: CueUAla
|
WriteConsole: Sides Idle Did
|
WriteConsole: 'CueUAla' is not
|
WriteConsole: QbSpanking
|
WriteConsole: Achievement Adv
|
WriteConsole: 'QbSpanking' is
|
WriteConsole: ekLoLay
|
WriteConsole: Persons Creatin
|
WriteConsole: 'ekLoLay' is not
|
WriteConsole: YNElementary
|
WriteConsole: Fin Gen Nat Pub
|
WriteConsole: 'YNElementary' i
|
WriteConsole: PqBeJULtQojkdOw
|
WriteConsole: iFIrNewark
|
WriteConsole: 'iFIrNewark' is
|
WriteConsole: ksUSquad
|
WriteConsole: Limiting
|
WriteConsole: 'ksUSquad' is no
|
WriteConsole: ozhYJay
|
WriteConsole: Relation Care C
|
WriteConsole: 'ozhYJay' is not
|
WriteConsole: sWRNw
|
WriteConsole: Trademark Ticke
|
WriteConsole: 'sWRNw' is not r
|
WriteConsole: UhProud
|
WriteConsole: Pounds Sounds P
|
WriteConsole: 'UhProud' is not
|
WriteConsole: tBQBeverages
|
WriteConsole: Aol Prior Europ
|
WriteConsole: 'tBQBeverages' i
|
WriteConsole: spHe
|
WriteConsole: 'spHe' is not re
|
WriteConsole: AKQui
|
WriteConsole: Sally Recreatio
|
WriteConsole: 'AKQui' is not r
|
WriteConsole: UTDfSciences
|
WriteConsole: Oakland Secreta
|
WriteConsole: 'UTDfSciences' i
|
WriteConsole: RPMfXTpVTSclYoY
|
WriteConsole: hpqMSongs
|
WriteConsole: Notified Partly
|
WriteConsole: 'hpqMSongs' is n
|
WriteConsole: CfAHPg
|
WriteConsole: Math Glass Intr
|
WriteConsole: 'CfAHPg' is not
|
WriteConsole: seCole
|
WriteConsole: Auction Window
|
WriteConsole: 'seCole' is not
|
WriteConsole: AjFormats
|
WriteConsole: 'AjFormats' is n
|
WriteConsole: aULAndrews
|
WriteConsole: Economics Else
|
WriteConsole: 'aULAndrews' is
|
WriteConsole: qkgTheir
|
WriteConsole: Receives
|
WriteConsole: 'qkgTheir' is no
|
WriteConsole: ApdmTerminology
|
WriteConsole: 'ApdmTerminology
|
WriteConsole: iNXqXNYdaBDiXFV
|
WriteConsole: XawsJelsoft
|
WriteConsole: Premiere Sugges
|
WriteConsole: 'XawsJelsoft' is
|
WriteConsole: OkFoDawn
|
WriteConsole: Wisconsin Switc
|
WriteConsole: 'OkFoDawn' is no
|
313 additional execution are not displayed above.
