Threat Database Viruses Virus.Virut

Virus.Virut

By CagedTech in Viruses
Published:
Last updated:

Threat Scorecard

Popularity Rank: 4,178
Threat Level: 80 % (High)
Infected Computers: 11,377
First Seen: March 21, 2013
Last Seen: September 29, 2026
OS(es) Affected: Windows

The detection of Virus.Virut on your system indicates a potential threat to your computer's security and integrity. This report aims to provide you with an understanding of what Virus.Virut is, how it operates, the symptoms of infection, and most importantly, how to remove it from your system to restore your computer's health and security.

What Is Virus.Virut?

Virus.Virut is identified as a Trojan-type threat. Trojans are malicious programs that disguise themselves as legitimate software to gain access to a computer system. Once inside, they can cause a variety of problems, including data theft, system compromise, and the installation of additional malware. The name Virus.Virut suggests it could be related to or a variant of the Virut malware family, known for its ability to infect and compromise systems, but without specific details, it's crucial to approach removal with a general understanding of malware behavior.

How Virus.Virut Operates

Trojan-type threats like Virus.Virut typically operate by deceiving users into installing them. This can happen through various means, such as downloading software from untrusted sources, opening malicious email attachments, or clicking on links to infected websites. Once installed, Virus.Virut can create backdoors for remote access, allowing attackers to control the infected system, steal sensitive information, or use the system for malicious activities like spamming or distributing more malware.

Symptoms of Infection

Symptoms of a Virus.Virut infection can vary but may include slow system performance, frequent crashes, unwanted pop-ups, and changes to your system or browser settings without your consent. You might also notice that your antivirus software is disabled or that certain security features are no longer functional. In some cases, the infection might not display obvious symptoms, making it harder to detect without proper scanning tools.

How to Remove Virus.Virut

  1. Enter Safe Mode with Networking: This will limit the malware's ability to interfere with the removal process. Restart your computer and press the key to enter the boot menu (usually F8, F12, or Del), then select Safe Mode with Networking.
  2. Conduct a Full Scan: Use a reputable antivirus tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove Virus.Virut and any related malware.
  3. Uninstall Suspicious Programs: Go through your installed programs and uninstall any that you don't recognize or that were installed around the time you suspect the infection occurred.
  4. Reset Your Browser: If your browser has been affected, resetting it to its default settings can help remove any malicious extensions or settings changes. This can usually be done in the browser's settings or options menu for Chrome, Firefox, Edge, etc.
  5. Reboot and Re-scan: After completing the above steps, restart your computer in normal mode and perform another full scan with your antivirus software to ensure that all threats have been removed.

Conclusion

Removing Virus.Virut from your system requires careful steps to ensure that all components of the malware are eliminated. By following the removal guide provided, you should be able to restore your system's security and performance. Remember, prevention is key: always download software from trusted sources, be cautious with email attachments and links, and keep your antivirus software up to date to protect against future infections.

Aliases

10 security vendors flagged this file as malicious.

Antivirus Vendor Detection
Panda Trj/CI.A
Fortinet Riskware/Generic
Ikarus Virus.Win32.Virut
GData MSIL:Dropper-NB
Microsoft Virus:Win32/Virut
AntiVir TR/Drop.217088
Kaspersky HEUR:Trojan.Win32.Generic
Avast MSIL:Dropper-NB [Drp]
Symantec WS.Reputation.1
McAfee Artemis!2398F6F4C7FB

SpyHunter Detects & Remove Virus.Virut

File System Details

Virus.Virut may create the following file(s):
Expand All | Collapse All
# File Name MD5 Detections
1. mspaint.exe 071b790d9c22f0b4dea3d4cdc47920e5 7
2. rundll32 .exe 2398f6f4c7fb2d6f6224f8c7b678be5c 5
3. mmc.exe 32a00814fb3b7ed6f943595420072aa5 5
4. ie4uinit.exe a37a1917e338efafe8b8bb246b4e8c78 3
5. cmd.exe 0658414f82b435aace3b014ddee75469 1
6. Fuel.Service.exe 1d74f2aa609169bdad764faab74e5ecd 1
7. wmpnetwk.exe 89c8e1174e598acd964f0ee54105751b 1
8. File.exe 48013fdcf7a83efd9c467d172556162b 0
More files

Registry Details

Virus.Virut may create the following registry entry or registry entries:
Regexp file mask
%PROGRAMFILES%\Microsoft\watermark.exe
%PROGRAMFILES(x86)%\Microsoft\watermark.exe

Analysis Report

General information

Family Name: Virus.Virut
Signature status: No Signature

Known Samples

MD5: 35d64bacfa91d35080b73e4690283660
SHA1: 06c2d8685ad970f234e800be395b0b9b31710c70
File Size: 1.81 MB, 1807360 bytes
MD5: 2cb38a16df39aaf240045d4e26363865
SHA1: d4b470cfb9e0f15e15eab3749e418bdb1c4aabc9
File Size: 17.79 KB, 17788 bytes
MD5: d2e3496f0712749ba29c78b7bf878dfe
SHA1: 096a6178c5c66bb2211219f2154b3a7bb467caee
File Size: 48.13 KB, 48128 bytes
MD5: af93c7a5e2dc5a2249b66e64c9e7535b
SHA1: 84b5fb6e21b989d5cb26a708a2de33394c1d1bab
File Size: 558.59 KB, 558592 bytes
MD5: 67ca408685e20a31011ad1b3a9f75b5e
SHA1: 0efe4e0de0882b0cfe5a4fd07ef133efed8f8323
File Size: 163.84 KB, 163840 bytes
Show More
MD5: 0ef54df43bd795393e6d99aa2df38d5f
SHA1: e2a34fea8eb81e37406a21283efaa1bc040e2427
SHA256: 51F14FB9EAF5892E4CF852ECC088BF9F956E298DC1E36D78F9F822B4DFD966EE
File Size: 597.50 KB, 597504 bytes
MD5: 442a276d65bf83e5254448b4e4144df5
SHA1: 4b68257d297ee66e250c28c6ed74b9beed3bfc59
SHA256: 4D52C60BA14B6F3097A269930AE3BE268B0DC7A0DB9B7216738B8F451BB3C6F7
File Size: 233.98 KB, 233984 bytes
MD5: c486aa4551033491a4ee1484dc00892b
SHA1: 873a58b8397755ba335f82c4c1b9ed773aea6a51
SHA256: 55EE6E26BBE1D0243C29BFAF8132D70EC5B976517545F92F9AB6F7428A28FF2C
File Size: 154.62 KB, 154624 bytes
MD5: 272a7566b6bbf1d6fdae13e4eff80037
SHA1: 032e55a065911242a4ffdc99dee350b99820f449
SHA256: 23C4A9BC6391C945EF9684D061874A631091DA863FD69B7372E484407247C4E1
File Size: 561.15 KB, 561152 bytes
MD5: 159a59fc62e4a6a7b13aaa55b022b353
SHA1: c2314411e0429f0c2979cb767163c3622036d924
SHA256: BF49728DC496003CA59D50AF357B406035299B9B223B573769E29A7775905067
File Size: 183.13 KB, 183134 bytes
MD5: ccc94f1d58e2702eac6dde089df9e401
SHA1: a2aaae3d7fcbaaa3a84e2ba1d19becc6a2036825
SHA256: CAD12B79FA800F3E2418F6D369C22E7EA5FA59635228AD1B8D41F28F64755E86
File Size: 109.57 KB, 109568 bytes
MD5: 7496af0996bf6c941905b63f8c264077
SHA1: 64cc45a3aa5e835de65e818bb5ab1d21937e2433
SHA256: D3AEFA5140C1FF0DA59E86FDAEC72AA61A1E7816E2D65179301F919C182D1AA5
File Size: 346.11 KB, 346112 bytes
MD5: 39ad146821b5c77230c7a87b5a614f23
SHA1: 893f1a3d9f6bc6ec5ad22e16ca056cdea7a75712
SHA256: 9056DC404800430E501F7414645DC6653B237110A87B65BA40700D618958BD46
File Size: 561.15 KB, 561152 bytes
MD5: be039a1815b5c22389609edf8db18dca
SHA1: cd449f985df747cc7af31201431fb92950402f23
SHA256: 3208AE85D14E14C50015D8A00A744885DD93891AA98D4243823B3FF7832E885C
File Size: 106.50 KB, 106496 bytes
MD5: 2edc870dba860df77f96e9182467e3fd
SHA1: 84e3484bebf3cea88b75aad91955f91e4babd8e2
SHA256: 6DC6047078CC5CFE9CE8F5CECECF7582515042E251F7A50901DC777D055FEF61
File Size: 6.70 MB, 6696960 bytes
MD5: 2b498481d57d2ca3ff2da9550d6f33ea
SHA1: dbe7b87d2ca0c2402a17ca11abe1fe5e052c0461
SHA256: ADE790B3145E95BE9A830EB0C96E63756799B38148DCB64366BF53C5431809D6
File Size: 1.03 MB, 1025192 bytes
MD5: 779682b26a10579823fbc4b9efbb2101
SHA1: 9b4be5d4d67547b50572516a193a36b43c09cd14
SHA256: BC7BC6AD672889A96D3C945302293A17403DF4F8458643AB599F924F207086A1
File Size: 400.94 KB, 400944 bytes
MD5: 1ae7946f4133829705b1a0d91161c0f1
SHA1: eeacafb7a73d7909e314c9bcefe9c974177565e1
SHA256: 85EA7FDB32FFC8D4A25530D832A2A7553686EEB91559841C4E54DF71B2A2B6F8
File Size: 188.87 KB, 188871 bytes
MD5: c7c7edd3dca67b61fccc227a5fbabc27
SHA1: 7a40ef2a180978ffa80e097e108d03bab0bd3117
SHA256: 4454190ED9C54EA4D0D221EDB901597816D6368674520F4801A0869E4C7A8FB0
File Size: 1.04 MB, 1038336 bytes
MD5: defd367e1b0037110d3ab3bbae3d4ece
SHA1: f19387ffd62032495f10f6f11a94401279195d48
SHA256: BF16C829B5D5ACE34A7FCF83AAA667003FB191B980D62E9B4564B109A3905C7F
File Size: 172.03 KB, 172032 bytes
MD5: 396cb1a5040a6596ed3c558b909902e6
SHA1: df55e422f65163b9eaf6ab3386a415377f70abf8
SHA256: 268073A785BF119CE5AA2E1B6288DDD6910329325E37FF074463BBF74C84CA64
File Size: 140.80 KB, 140800 bytes
MD5: c672638db09e8d495d68b178e344d937
SHA1: 829e6bea564e31f37c9b1e77406869437be279aa
SHA256: 74377502B7A339952796B20D0AAA36892A1B9AC4FD504DB6160B2F884C70027A
File Size: 122.88 KB, 122880 bytes
MD5: b5b892c624579ff9e7616e99c8910790
SHA1: b3a459e92623a79f445efca363ebb1771ab90422
SHA256: DBAC3421188074C989B4F71B2B94AE73937412306A1FC2A44491FAEC9EE41F36
File Size: 188.87 KB, 188871 bytes
MD5: 66b9240c6f12b90b2600a921b0e72b73
SHA1: db993b231f0b348538a23bd6ca6acd219eaa3bfe
SHA256: 1E71180F45B693C0040D68FAEA56FBDB8591B06FBF7C14FCD295296FD666DA0A
File Size: 86.53 KB, 86528 bytes
MD5: 1f0b5297624729ceef5c934c77572b5b
SHA1: a633a12d29892fbb2220c892c92b12a8d4c4eebe
SHA256: 3A6622C05AE5F78ACCFCC03C7392DB132209AEC3D64FE86D4FF9404E2DA8B636
File Size: 54.27 KB, 54272 bytes
MD5: d815a72ff4052f7675f37539f68cd0d2
SHA1: 584ae243465fe9b071ac1a7ac0bb306fa8db9edf
SHA256: 8A0BE1252263C827E2A3F7E75EDC0B204D67DFF78DB82A4D5326A0A901E27DEA
File Size: 5.66 MB, 5660672 bytes
MD5: 1a29474fb9874a6fdc4b725af7712bbd
SHA1: 9ba876f16540138f80add98edb4e46a8173984ee
SHA256: 956FA265702259338222C802FF9A9941D20FEC6B1789B9CC2222F0C524265798
File Size: 154.62 KB, 154624 bytes
MD5: 7dd1b49e63fab79862ee764053f44402
SHA1: 59d083a391b3b8543dba6d97d273cc94f20fa6ea
SHA256: FAC947B62486E88511B961FB12FD4B8BFE0006318AB3F69252E4CDE4B11F71A2
File Size: 74.75 KB, 74752 bytes
MD5: a3de8c6410d3a496a62a61a771b58e6c
SHA1: 9d4acfa2943825d7d57ef39b53fe247ac0eaff6b
SHA256: 11E38216FAC5010DCE4AE0780A7734032BC6D7AA0C9FAE7DDC7F83E7C264D630
File Size: 799.04 KB, 799036 bytes
MD5: ec65d69a41b9d27d1f5a96cf48ad27c5
SHA1: 487722009e861728eb4782979ae72c743fb583fc
SHA256: 428DCA195E8137E7AD3E451DE00FEAB5451468787B1F6BD7E4B1C40F1E568C1F
File Size: 170.79 KB, 170792 bytes
MD5: 92d2f555810284801b78eae745860674
SHA1: 6d1b342e15936b13e0c4f7ae667d7bcfc17591d3
SHA256: 120FDB39ABB301686E460FAFAC1A829012472DCC80C28A2AA85404EBFEADC864
File Size: 23.04 KB, 23040 bytes
MD5: 754101a819c3edb9180ce458ff7c388a
SHA1: b42fbb8a69104530f13ef6ee0d0b5406a32ee5bd
SHA256: 665A7D8BAB05835D7ECC43CC775AC7CF3B268514DD6F98B1F879AB0E8E5EBF72
File Size: 1.76 MB, 1762304 bytes
MD5: ebdb22873b88f67a56a82409de82d95c
SHA1: 1dccdc95878b8f614d5920fb29fb7276c1c187e9
SHA256: 6D3072B5094A4FF574F9805127FEC1B35767538228542D1F570FC007EF66BE15
File Size: 11.26 KB, 11264 bytes
MD5: 0d90031fbcb7f52559f1bd48162ed3a8
SHA1: ecfddcfef0c66d14527b98d9b5917937af913a25
SHA256: E58109024E0DC3017C934295A990F5293F2BBCDA56EFB5F46D8670034E8F5868
File Size: 84.99 KB, 84992 bytes
MD5: 7de47ee9f7385a8c949d2d86ad6a0180
SHA1: cdc41edc61f1bf7279533f9d65d95983597168ab
SHA256: F617D011846A1EA4C5A685916A374EE156D2AF893AACA3782E2536574E9F55FD
File Size: 190.46 KB, 190464 bytes
MD5: c760415da74f99770507473e85029e95
SHA1: 0459add54f7233a77c4bfb3fb71dcecad671e5a8
SHA256: 18E134AC9DCE7AE188AFDFB9BBF5B027E11940F5E8D30891F2F1F2D747184370
File Size: 3.96 MB, 3958784 bytes
MD5: e397cfe8de5dc026581ecee4d91dd1d4
SHA1: 5ed0a733513dade7e04ffd44be9c207264bd6581
SHA256: EFEFBA2A7025C82F3C9DECDBBCC622E566AE66A76EF4E87086558A28F65B7FF3
File Size: 156.16 KB, 156160 bytes
MD5: 0ba4b0cd37768d5377b4474d4bfa7c1c
SHA1: 3f0e32e667afda4150c8c8ad9428b17dae6a8c10
SHA256: D0FF8CB23895A1613328EC176BDAC5488BBA2B26A8159A47A4147DF569496115
File Size: 4.87 MB, 4874240 bytes
MD5: 6dc0d43a63281d421b2ca5fcf6a61568
SHA1: a494984eba84f665914d298003719e5363ff7d99
SHA256: 0420625A7656BAE0501C270FC0BE940224D9F329DE3E80290D05011FB6D1A120
File Size: 68.61 KB, 68608 bytes
MD5: ee14ae010e6997205f57d624f54fa231
SHA1: e441c57b62706b314e11ded0558daadcb2c8e9ab
SHA256: 1F069D0CB5D57C1968FE092AB42117CB63A7AC0E4B96171D04E512C53AE0EC21
File Size: 1.01 MB, 1008190 bytes
MD5: 51b8c989bea52e72d063481c71a67dcd
SHA1: 1c69d7b112a323d8fb68133ee6cfb6e0876baad4
SHA256: 8084A9C0BC8B422EF98E2D0F50A5F04DE3BA76AA379346D4BDAC5D23682D0663
File Size: 131.07 KB, 131072 bytes
MD5: 522346eabfb982c23e668fd854fcbaf7
SHA1: 58ab5e899f15b0662dd1f681573ae215f9a8726f
SHA256: 2FC6EF990B73A082DE6EEA55F508592DF7F538EEFD7E0D40AEA5EB2D47323E6B
File Size: 1.77 MB, 1774080 bytes
MD5: 2d0ae11c05e456ec831cedffc9dd4581
SHA1: 65f61ddbb7c1c274d56526560b2a3d6b280fbda1
SHA256: A04560B29E7D21FB7657A3BC08FF3B227B484309517E7F144D9F810555A095FB
File Size: 2.74 MB, 2735104 bytes
MD5: 9c1ab8575168088eded7a1c94aaf802c
SHA1: 4ffe9218d371b3b0707055ca733580446be1c804
SHA256: 15ED565F29EBE23B5D63426E50068A4235E452E9F73812A9B0F7EA40177ACB73
File Size: 278.53 KB, 278528 bytes
MD5: 50caab5b3cbb1ced9ecbb998dabae74e
SHA1: cf656abc4514d2ef059d010ac634a5cbb159a5b0
SHA256: E10C65DE4519BC1EA217F5755E3E2D463F04CBE5147F387D082CF2821DE2D098
File Size: 411.14 KB, 411136 bytes
MD5: f3de164bb2133f8243bed7c4e237ad5f
SHA1: d29e58ba5f5233f7c2682dcec1eb5b22a8980b48
SHA256: 74C82CC70F11177A9792D58635885F1CC115D64C2E7A01F2A7F4E8740FD26CC3
File Size: 217.64 KB, 217639 bytes
MD5: bef099cee0a5c58aee45f53bab7ed82f
SHA1: e19de81376582d8931ae933499e4428c8a445ef2
SHA256: 787237DA95F8D562373A7753B66DFA16B05F85E8D445778B435BEC0CE7572ED8
File Size: 107.52 KB, 107520 bytes
MD5: 2853c8c8bfa913e20ae142274addcc0c
SHA1: f5727f831034412f2eab73b9aad537e0e7ad2cd6
SHA256: 508A740910F4749295628B1128D008AFE19F6F3463021496D18B1A3A28482389
File Size: 57.86 KB, 57856 bytes
MD5: 7386c345775ad5b228ba58951d7d56d5
SHA1: 2e14a9c3b359d21e9db878498b23ef995e272b32
SHA256: 0313DA687024A792AF156370CFEF850431063788830F09A85DE6ECDA5AEF3A6A
File Size: 229.89 KB, 229888 bytes
MD5: 892935f7b969cf3e8ae4fd9420cb6361
SHA1: b8dedc3feff46d0c2917868b8f473d90adf2c5e9
SHA256: 1B2D6B188618A9C8807748783EB339CEEC03A63CBA198EB647B08532EB1D2EEE
File Size: 330.24 KB, 330240 bytes
MD5: 13bf6b690853887f3d1fb4b785c29c37
SHA1: 744f9e2348824f744cbbb7955fd857ef47973895
SHA256: 69F1BC98C17C9777FCA81DB5342F443852333D8E046E95560593241C7DAFCA21
File Size: 17.91 KB, 17913 bytes
MD5: 31a3ff9dd69dd3441c50e92f5808ca43
SHA1: d91cfce794fc5c550d93b4bbe0c8ccfbb3929e8b
SHA256: BF30945546C115732864668EA746D56FBD05594BB75800E21C5D3F09937C15D5
File Size: 6.08 MB, 6078464 bytes
MD5: 6f11a72a45b36d5d43d1a46810496e0e
SHA1: edae2ad37d349daefcba3e3e6485d8e4311b6d67
SHA256: A3F4192AB9460E9BA78D91056D17B6F0C9DCE18BC40E3AA3B6039862760702D5
File Size: 423.52 KB, 423518 bytes
MD5: 32fe8e1b784d4a187cf716feb81cca06
SHA1: b69e48dfd2c1ae16a102b7db4b0be4fca13a557b
SHA256: 28B607CED70F58777AEF28BE068841F206A4EF8C19A23EEAC2936D6BD3EAA4AD
File Size: 1.33 MB, 1328232 bytes
MD5: feeed337f32dbfd28f3da8f17c38f46a
SHA1: 168c748e710e30d8f84885c2d974463943e7db85
SHA256: 7C0B2B143CE3311177D789EB3232A1C72FC6A2D94EA8C16EC28A0B1BFFFFE097
File Size: 205.82 KB, 205824 bytes
MD5: ad0766b61863d2438f91f73f4edb32e7
SHA1: c987f6565759dcccd3f8cf5bb99635f3631f393e
SHA256: 63B4D9B82DD1BE207302B5946BE485DCE3E8AE6BD1728D6F97006B3404E5F3F5
File Size: 770.05 KB, 770048 bytes
MD5: c5ad54fce44e33773a339534c486c988
SHA1: d03e1f8c8eeda21e5cd2b85c9cc1eed144cde898
SHA256: CF423B0393FF2EFC1A9797A1E89565D09DA5DD4E13B64DA7EB2FB20EB3A4A92D
File Size: 179.71 KB, 179712 bytes
MD5: 1f5819f433155d58e6a36ca08c317a4d
SHA1: eb7857c0ae2abece28116a6d6f18798f7639c57f
SHA256: 269216E3FD7356E1443F16CC4A1AD07B3182D8436AC966DDCDF14ABBB5860459
File Size: 114.22 KB, 114218 bytes
MD5: 38a32e07d4629e44605079042ad2176d
SHA1: 74d53076d1bf479df04a83fd8fda893ebaf176d0
SHA256: 7898DC66E673FA867C9EDED0E60195B42B0742E93C4F33355068052CC2BF051A
File Size: 546.30 KB, 546304 bytes
MD5: 6646fc78a0a66a5292026dc08e2528a2
SHA1: ce4edcf1eb65dd0a529b0c57c14aa8f369c83e38
SHA256: A41F833B8FE31839F1D78116839A23F7BE65B84B3DC61B16801A8FB1D2CA55A9
File Size: 28.67 KB, 28672 bytes
MD5: 14dc4b9a0900df5c5f7ba7686b72470b
SHA1: 9dad87f0b357b9d4c4d1fce78dd70b02b0f12752
SHA256: BF12B8C6381A013AD0EDD0117F983612C89770715A512D55EB1D7C0EFBAD8B66
File Size: 2.37 MB, 2367488 bytes
MD5: 282f3b8289a166214b66897413fa69fb
SHA1: eacdfb69b63ee16ad585a9416f7db57f24f1c4d5
SHA256: C2D212CC42EB46BEEDDFA1379C07E6FDF7BBA4357458837133104426B5E72DDC
File Size: 278.93 KB, 278932 bytes
MD5: f364ccf95a39483a135d63160b6838af
SHA1: dc9068fb96dd46fd3923c222eb71f4be7aa1089f
SHA256: C55AE98C3CDCD6E034D4EEB7C36A839448379DEC78CE456E572F18D8948AB768
File Size: 204.29 KB, 204288 bytes
MD5: 1bb3138248ed0e0729012b22fcc1763d
SHA1: fe8509fff661fc48e21b576a82489893df5a2eaa
SHA256: 7289FBC4ECBAAB1C5EE286C61873DF5F56AD53ACBFBFE226D91466AE73518282
File Size: 427.86 KB, 427856 bytes
MD5: e2f646e4643cf3df552862398483b522
SHA1: 7d9f77dbe136f80568616da6a560d653e291797a
SHA256: 59941AA382F2A8E3EC6EF451D4F3B96FA1967B4A2CEAD7465650971874DBA027
File Size: 140.80 KB, 140800 bytes
MD5: 8b2fa614de84e9038c501ed87b275e7e
SHA1: f6a6637aafd3410728ddea5a96092cc9265b1092
SHA256: 529394A6CBDBBB0787B533C5808B4BDE583F6D800F5CAE1E41725CC36E29CAE1
File Size: 290.82 KB, 290816 bytes
MD5: 433b87157f368bf117fa6463853baeb4
SHA1: 7e816dde1b1a8bf1c19073dc9deeca3d6fd0d2b1
SHA256: 79FFA7DCB8800B22BA1FFFB5EA128EF60C3F1CA76A9D204D21A2B96432F52C80
File Size: 233.47 KB, 233472 bytes
MD5: 3f07e66197416fa3e5d23f6925515166
SHA1: 35d0c9fa88632574ae5162bdcd6d552f0467d616
SHA256: 80F8D4F937D9F149F667036E79405DC2AF693F57095A2225ED0DEC62D4E5B672
File Size: 251.78 KB, 251781 bytes
MD5: c315313ac9913f6ed39cc0344198b1d9
SHA1: 1cffe58c2d02832c5625d1b95c4b87c7d7b3f34d
SHA256: 4AF9580BED372761E85EE5971CFF3B79176B00D6E480C3634164E258882194F7
File Size: 5.28 MB, 5284352 bytes
MD5: eadf35b7f4a00329a6c8772494171801
SHA1: 8472fa8a072ed45067a10655134b11ad247109d0
SHA256: 9208922463D9D04E3BBBDF432738F6E3B8DC5141A36D2A7C0D8737EB18952110
File Size: 151.55 KB, 151552 bytes
MD5: ec3f4f7491d659bb610070a92f6485c0
SHA1: 44565ce8e57729966acc7a8f106f584665bf1735
SHA256: 5DCD0C9BAD71A5CC581FF1732661E568C083EE64A15B8C911D4B3C33EF3D84B1
File Size: 240.92 KB, 240920 bytes
MD5: 9f72961ca31bfa38cbbc4cf56211e1f6
SHA1: 83bf2f5ed6c307f69eeaccd7c1d0cfc754971f20
SHA256: 29C06E4F6B7EC865EEDF3C161C407A8DB864769422304F8EECFED69A8BED34D6
File Size: 5.84 MB, 5836800 bytes
MD5: f0a03d17b396824632546009ce418ba1
SHA1: eb69aa9d8fe642790034dc4be424e14ac1087ce1
SHA256: 554FA56F0AD721CCC430404C10D2841685A9658A0AB0E6EC972220D9D2B21798
File Size: 139.67 KB, 139672 bytes
MD5: 1d3dad26a559127313bbad5b1767bae5
SHA1: 4e49e60b39d3548bc819be54d770fa290c7857b9
SHA256: E55EC189693A9CD813753A6D1D482AF4ABDBB008F23B2977B71B2BCBFF468A5F
File Size: 44.54 KB, 44544 bytes
MD5: e2cddcb3c769176b86e4480d327059a8
SHA1: 723c8d5e25955a44e4ad6d10d80ebe4fa711d715
SHA256: 775B7746466AD35C7FAF0E56F66ACC865926B321B34188510B9B26047CF82DE5
File Size: 110.59 KB, 110592 bytes
MD5: f3db463163e45f0d8a7c0ec2ab3cd649
SHA1: 0f1ef50dcb1dec644803c06f1640525d6a7c1ad6
SHA256: 462335422D163F62B4B657CA50139C7ADAEE5740B3F0914481BA254B6CD67A37
File Size: 753.66 KB, 753664 bytes
MD5: 013ad2c8033c85107d4ce74b16f0eb6f
SHA1: f5da66b4dfa3e2ee801fb8211b917dc55dffd996
SHA256: 3DCED0085BBE4F3EC4F35063FA981B3CE2FAB2F2D7ECE7F38B25F944ED653AC5
File Size: 20.48 KB, 20480 bytes
MD5: db8ad7df743ea10e939072286db27b05
SHA1: b6fb2d14bf9533fce3cce3163a1a75fa90e15a51
SHA256: 382D55DA9EF847E201C5757B453B8E841903125E316E3990CD2BEC9FDC9707D1
File Size: 443.90 KB, 443904 bytes
MD5: 23a5a2e0f41d6f5d1cb47223d0b2bf7e
SHA1: 4896c1f7c4b83fa5f8cd70368c6ab4ed5feccfeb
SHA256: 57A9BA7BBC594D8C3D8119E6A955F46E70DE8885504EFE9797FF0514790B7193
File Size: 159.23 KB, 159232 bytes
MD5: d913706cf8cac14630f6c9199cf877ec
SHA1: b9f097fd647b579421c5d95027a94b4f16437244
SHA256: 0335E2B7947DE6B3425C20D2404AD648F62869D31830F2FD1F2B06BD5F57A86D
File Size: 53.76 KB, 53760 bytes
MD5: 0c9e52cde7a2b5bbd9ef08a79ddbdcd7
SHA1: fa808089b4c0e7576cf8412234b15955357e41f1
SHA256: EA262CD5717D32B078861AC5E6F65B6D1A5858C417483B77D53F979DD582666C
File Size: 39.42 KB, 39424 bytes
MD5: 9dfff1888202771f39effc08164d31a5
SHA1: a93dfb6faa8ce6abef25934667968aee96f7a0a1
SHA256: 65772F2E62E194B122F17235AB16B0851DEDDCC5D45EA0E2ABF67FF2C16A7DF5
File Size: 17.84 KB, 17845 bytes
MD5: 14db153059457f4f1f1c17ac0c444355
SHA1: dee2a93ee39e7ff5d58b9b35528a4e5cdaefb39e
SHA256: 427A95667DB22A9B00F05C65A6939B25542FD6E5CD1B15230BEAC30CFD02154B
File Size: 274.43 KB, 274432 bytes
MD5: f7ece6b93e7b3b68a16130ae219fa4cd
SHA1: f4c0af4b6114fba0687c2363eb29eea1c0f95455
SHA256: 93AA321A9452CDFAFF59FF99E016D80384AB0AB5DE1A0DB7EAE8F2FD8B8AE7BA
File Size: 6.25 MB, 6252611 bytes
MD5: b6f20cf68af72c834f79dbe1a3b6a108
SHA1: 5f06905591889847c95942a97b467a093a527348
SHA256: 18E3F3B17B4846EA47CD4E0FCE647FD177A8701E8B258A659AF362D7B568FFC2
File Size: 2.36 MB, 2363392 bytes
MD5: a193b9c2fb46488d70ed91b9bb5382b6
SHA1: fd8ba02dd123d8ae3929abd9ff64371783a5d280
SHA256: 3B4BDE5AD60ED86D1AFE2D48584C6CD010B9C6F2BFC410DFAABB4FE113613AA7
File Size: 454.66 KB, 454656 bytes
MD5: c4e2bfbf8b2aab543705ebb73cbac1ae
SHA1: ceb04ba8685c65395bc270bf75d72353d822bd02
SHA256: 66C75D3F03509D06F88E4F03765D59491F7465CEB33E4828F4763149FF1BD15B
File Size: 275.61 KB, 275608 bytes
MD5: fe687ae499fe7e4dec3ae187f6030fa2
SHA1: c3c004a25cae312bd20ff62e157f86bd3cc08715
SHA256: 02EEF00C0FEB9A33A99E4F3397A8BD6593F02A266F4E86D13D28652B3FCD28A3
File Size: 1.43 MB, 1431552 bytes
MD5: 2f2bb26be4aeae78416f23e756881b68
SHA1: 415df5adae16ee813eaf1028e9267c1846eb9a96
SHA256: 4F6423F1AB6F4DC06D9301BAEE4C184FA7E128B6A0EBF9ED7EBD18EA03EBB3A8
File Size: 1.17 MB, 1171456 bytes
MD5: 80a15b7e992356ff9ac1b16b9a60a45f
SHA1: 8817bec319b3c2241a00e5c6a679e147ba1f9e27
SHA256: A306C9625B28778A0BCFA671DE17736D01DD5787F8D35320FE91C9D41CA2A5A2
File Size: 1.93 MB, 1934336 bytes
MD5: 19a44c9976f4bee1f443d14237812462
SHA1: 88a003a38079c546fa900285d4510389352d0e98
SHA256: 4375C286E7DC5FF0C0B33336B37460C02220A6465C07458185A22A116EAE99E5
File Size: 646.66 KB, 646657 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have resources
  • File doesn't have security information
  • File has been packed
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
Show More
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Show More

182 additional icons are not displayed above.

Windows PE Version Information

Name Value
Author musvc Hack4cent
Comments
  • Adorage Application
  • A simple disk transfer rate tester for WinNT
  • Created with E-Batch maker v1.3
  • Help Documents with Partition Assistant.
  • Inject For Tunnell
  • ST10Flasher
  • UIU Build. Includes all features.
Company Name
  • 3ivx Technologies Pty. Ltd.
  • @BIIN
  • Alcohol Soft Development Team
  • almalik cobra
  • Aomei Technology Co., Ltd
  • Conexant Systems, Inc.
  • Corel Corporation Limited
  • Eastman Kodak Company
  • Electronic Arts Inc.
  • FlulpyCrea
Show More
  • Huidu
  • Inner Media, Inc.
  • InstallShield Software Corporation
  • Integer
  • Intel Corporation
  • Lavalys, Inc.
  • Macromedia, Inc.
  • MapInfo
  • Microsoft Corporation
  • Panasonic Corporation
  • proDAD GmbH
  • Rocscience Inc.
  • Scienter Technologies (Pte.)
  • SCPBW32
  • SOFTWIN S
  • SteelBytes
  • STMicroelectronics
  • STSPrint Software®
  • Synaptics
  • Treyarch LLC
  • Valve
  • Vision Objects
  • Volkswagen AG
  • Winamp SA
  • مكتب دلتا للتطريز والبرمجة
Favorite Website http://www.AT4RE.com
File Description
  • 3ivx MPEG-4 5.0.4 Configurator
  • 32-bit Active Delivery Self Extracting Front End
  • 32-bit Setup Launcher
  • Alcohol Launcher
  • almalik cobra
  • Battery Recalibration
  • BitDefen
  • Change Computer Performance Settings
  • Conexant Universal Device Install/Uninstall Application
  • Corel Writing Tools Utility
Show More
  • Desinstalador
  • Dips Executable
  • Electronic Arts AutoRun
  • English to Bangla Dictionary with bangla to english search, vocabulary tests and practices
  • EVEREST Ultimate Edition 2007
  • Flahser for ST10 family embeded flash
  • Half-Life Launcher
  • HD2018
  • Help Documents
  • hkcmd Module
  • Input Personalization Server
  • InstallShield (R) Setup Launcher
  • Internet Low-Mic Utility Tool
  • killKSS Application
  • LUpdate MFC Application
  • Macromedia Flash Player 7.0 r14
  • Manages scheduled tasks
  • MapInfo Data Installer
  • MyScript Notes Application
  • Offboard DiagLauncher
  • People Near Me
  • proDAD Adorage 3.0 Application
  • rm2303 MFC Application
  • SCPBW32
  • Server MFC Application
  • Setup
  • steel_debug
  • STSPrint BarcodeDV
  • Synaptics Pointing Device Driver
  • Timer MFC Application
  • Userinit Logon Application
  • Winamp Agent
  • Windows Command Processor
  • Windows Control Panel
  • Windows Mail
  • Windows PowerShell
  • Windows Update
  • Windows Winhlp32 Stub
File Version
  • V1.3
  • V1.0.35.3656
  • V1.0.3.58
  • 106.42.73
  • 17.00
  • 14.0.23107.0 built by: D14REL
  • 11.00.26100.1150 (WinBuild.160101.0800)
  • 10.0.26100.5074 (WinBuild.160101.0800)
  • 10.0.19041.4355 (WinBuild.160101.0800)
  • 10.0.19041.746 (WinBuild.160101.0800)
Show More
  • 10.0.19041.1 (WinBuild.160101.0800)
  • 10.0.10586.0 (th2_release.151029-1700)
  • 9.1.0.636
  • 8.15.10.2302
  • 7.5.7601.17514 (win7sp1_rtm.101119-1850)
  • 7, 01, 100, 1248
  • 7,0,14,0
  • 6.1.7601.17514 (win7sp1_rtm.101119-1850)
  • 6.1.7600.16385 (win7_rtm.090713-1255)
  • 6.00.0154
  • 5, 52, 164, 0
  • 5,9,2,10042
  • 5, 0, 4, 168
  • 5, 0, 0, 1
  • 3.80.873 Beta
  • 3.52.49
  • 3.3.1200.0
  • 3.1.2.0
  • 2.00.04
  • 2.00.0075
  • 2.0.0.1
  • 2, 0, 0, 21
  • 2,0,0,0
  • 1.9.7.6319
  • 1.4.0.43
  • 1.3.0.0
  • 1.1.0.1
  • 1.09.01
  • 1.00.00
  • 1.00
  • 1.0.0.4
  • 1.0.0.0
  • 1.0
  • 1, 3, 0, 1
  • 1, 2, 0, 0
  • 1, 1, 1, 1
  • 1, 1, 0, 4
  • 1, 0, 0, 1
  • 0.780.618
Internal Name
  • 3ivxConfig
  • Alcohol Launcher
  • almalik cobra
  • AutoRun7.exe
  • Bangla Dictionary
  • Brecal.exe
  • cmd
  • Control
  • Delta4
  • Dips
Show More
  • EVEREST
  • fsquirt.exe
  • Half-Life Launcher
  • HD2018.exe
  • Help.exe
  • HKCMD
  • ielowutil.exe
  • InputPersonalization.exe
  • Inventory
  • ISPNickel
  • LUpdate
  • Macromedia Flash Player 7.0
  • MapInfo Data Installer
  • MyScript Notes
  • p2phost.exe
  • POWERSHELL
  • proDAD Adorage 3.0
  • rm2303
  • schtasks.exe
  • SCPBW32
  • SDIAG
  • selfxfe
  • setup.exe
  • ST10Flasher
  • steel_debug
  • STSPrintBarcodeDV
  • SystemPropertiesPerformance
  • Uninstall
  • Update
  • userinit
  • Winamp Agent
  • WINHSTB
  • WinMail.exe
  • WTSPTLEN
  • wuauclt.exe
  • © Microsoft Corporation. All rights reserved.
  • фжзрюкшэщ
Legal Copyright
  • (C) Panasonic Corporation 2004-2014
  • 2528-6
  • @BIIN
  • @STMicroelectronics 2000
  • Copyright (c) 3ivx Technologies Pty. Ltd. 1999-2011. All rights reserved.
  • Copyright (C) 1990-2002 InstallShield Software Corporation
  • Copyright (c) 1996-2003
  • Copyright (C) 1999
  • Copyright (C) 2000
  • Copyright (C) 2002
Show More
  • Copyright(C) 2002-2008 Alcohol Soft Development Team
  • Copyright (C) 2003-2006
  • Copyright (c) 2003-2007 Lavalys, Inc.
  • Copyright (C) 2006
  • copyright (c) 2007-2018 Volkswagen AG
  • Copyright (C) 2008
  • Copyright (C) 2008 Eastman Kodak Company. All rights reserved.
  • Copyright (C) 2009 Aomei Technology Co., Ltd. All Rights Reserved.
  • Copyright (C) 2010 by proDAD GmbH, All Rights Reserved.
  • Copyright (C) Huidu
  • Copyright 1999-2006, Intel Corporation
  • Copyright© 1990-1998 InstallShield Software Corporation, Phone: (847) 240-9111
  • Copyright © 1995-1997, MapInfo Corporation, Troy, NY, all rights reserved
  • Copyright © 1996-2003 Macromedia, Inc.
  • Copyright © 1997-2000 by Inner Media, Inc. All Rights Reserved.
  • Copyright © 1997-2023 Winamp SA
  • Copyright © 2000
  • Copyright © 2000-2004 SteelBytes. All rights reserved.
  • Copyright © 2002 Corel Corporation Limited. All Rights Reserved.
  • Copyright © 2006
  • Copyright© Conexant Systems, Inc. 2004
  • Todos los derechos reservador por GUILLERMO RICARDO FLOOK
  • Waliul islam mondal
  • www.cobra.arabe.pro
  • © 1996-2009 STSPrint Software®
  • © 2004-2005 Electronic Arts Inc.
  • © Microsoft Corporation. All rights reserved.
Legal Trademarks
  • Active Delivery is a Trademark of Inner Media, Inc.
  • Alcohol Soft Development Team
  • FlulpyCrea
  • Macromedia Flash Player
  • Nullsoft and Winamp are trademarks of Winamp SA
  • STSPrint Software® BARCODEDV
Original Filename
  • 3ivxConfig.exe
  • Adorage.exe
  • AutoRun7.exe
  • AxCmd.exe
  • BanglaDictionary.EXE
  • Brecal.exe
  • Cmd.Exe
  • CONTROL.EXE
  • Delta4.exe
  • Dips.EXE
Show More
  • everest.exe
  • fsquirt.exe
  • HD2018.exe
  • Help.exe
  • HKCMD.EXE
  • hl.exe
  • ielowutil.exe
  • InputPersonalization.exe
  • Inventory.exe
  • IPBOX.EXE
  • LUpdate.EXE
  • MIGM30.EXE
  • MyScriptNotes.EXE
  • nedwp
  • OffboardDiagLauncher.exe
  • p2phost.exe
  • PowerShell.EXE
  • rm2303.EXE
  • SAFlashPlayer.exe
  • SCPBW32.DLL
  • sctasks.exe
  • SDIAG.EXE
  • selfxfe.exe
  • Setup.exe
  • setup.exe
  • ST10Flasher.exe
  • steel_debug.exe
  • STSPrintBarcodeDV.exe
  • SystemPropertiesPerformance.EXE
  • Uninstall.exe
  • Update.exe
  • USERINIT.EXE
  • winampa.exe
  • WINHLP32.EXE
  • WinMail.exe
  • WTSPTLEN.DLL
  • wuauclt.exe
  • © Microsoft Corporation. All rights reserved..exe
Product Name
  • 3ivx MPEG-4 5.0.4
  • 32-bit Active Delivery Self Extracting Front End
  • Alcohol Soft Development Team
  • almalik cobra
  • Battery Recalibration
  • Conexant Universal Device Install/Uninstall Application
  • Corel Writing Tools
  • Dips
  • Electronic Arts AutoRun
  • English to Bangla Dictionary with bangla to english search, vocabulary tests and practices for GRE,TOEFL and others
Show More
  • EVEREST Ultimate Edition 2007
  • HanEdit
  • HD2018
  • hd_speed
  • Inject For Tunnell
  • InstallShield (R)
  • InstallShield®
  • Intel(R) Common User Interface
  • Internet Explorer
  • Inventory Control
  • killKSS
  • LUpdate Application
  • MapInfo MapX
  • Master Control Client
  • Microsoft® Windows® Operating System
  • MyScript Notes
  • Offboard Diagnostic Information System
  • Partition Assistant Help
  • proDAD Adorage 3.0
  • rm2303 Application
  • Sapco Automotive Diagnostic
  • SCPBW32
  • Server Application
  • Shockwave Flash
  • ST10Flasher2.0. November 2000
  • Steam Half-Life Launcher
  • STSPrint Software® BARCODEDV
  • Synaptics Pointing Device Driver
  • Treyarch LLC steel_debug
  • Update
  • Winamp
  • люзанх
Product Version
  • V3.03L12 M00
  • V1.3
  • V1.0.35
  • 106.4
  • 17.00
  • 14.0.23107.0
  • 11.00.26100.1150
  • 10.1.10.11
  • 10.0.26100.5074
  • 10.0.19041.4355
Show More
  • 10.0.19041.746
  • 10.0.19041.1
  • 10.0.10586.0
  • 9.1.0.636
  • 8.15.10.2302
  • 7.5.7601.17514
  • 7, 01
  • 7,0,14,0
  • 6.1.7601.17514
  • 6.1.7600.16385
  • 6.00.0154
  • 5.2.3
  • 5, 52
  • 5,9,2,10042
  • 5, 0, 4, 168
  • 5, 0, 0, 1
  • 3.80
  • 3.52.49
  • 3.10a
  • 3.1.2.0
  • 2.00.04
  • 2.00.0075
  • 2.0.0.1
  • 2, 0, 0, 21
  • 2,0,0,0
  • 1.9
  • 1.4.0.43
  • 1.1.0.1
  • 1.09.01
  • 1.00.00
  • 1.00
  • 1.0.0.0
  • 1.0
  • 1, 3, 0, 1
  • 1, 2, 0, 0
  • 1, 1, 1, 1
  • 1, 1, 0, 4
  • 1, 0, 0, 1

File Traits

  • .aspack
  • .UPX
  • 00 section
  • 2+ executable sections
  • big overlay
  • dll
  • GetConsoleWindow
  • HighEntropy
  • Installer Manifest
  • Installer Version
Show More
  • MPRESS
  • MPRESS Win32
  • Native MPRESS x86
  • No Version Info
  • ntdll
  • packed
  • PEC2
  • SusSec
  • upx
  • UPX!
  • vb6
  • VirtualQueryEx
  • virut
  • WinZip SFX
  • x64
  • x86
  • ZIP (In Overlay)
  • ZIPinO
  • Zprotect

Block Information

Total Blocks: 2
Potentially Malicious Blocks: 0
Whitelisted Blocks: 0
Unknown Blocks: 2

Visual Map

? ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Agent.ACB
  • Agent.EDA
  • Agent.HJG
  • Agent.XFL
  • Autorun.SA
Show More
  • BadJoke.XA
  • Banker.RDA
  • Brute.PVE
  • DataStealer.A
  • DataStealer.B
  • Downloader.Agent.GH
  • Dzan.A
  • Expiro.A
  • Expiro.KA
  • FareIt.AW
  • Farfli.CF
  • Floxif.D
  • Gamehack.ODB
  • IEHelper.B
  • Injector.IB
  • Injector.PMB
  • KeyLogger.B
  • Keylogger.DF
  • KillMBR.XB
  • Kryptik.DGE
  • Kryptik.GSJ
  • Kryptik.VCKV
  • Lamer.CF
  • Loader.C
  • Lokibot.G
  • Lotok.A
  • Lotok.T
  • Lumma.NB
  • Poison.X
  • Ramnit.AP
  • Ramnit.V
  • Sabsik.G
  • Sadenav.B
  • SchwarzeSonneRAT.A
  • Spy.Keylogger.X
  • Stealer.BBA
  • Talsab.A
  • Trojan.Agent.Gen.ZW
  • Trojan.Downloader.Gen.KL
  • Trojan.Injector.Gen.GTU
  • Virut.I
  • Virut.IB
  • Virut.IE
  • Virut.IF
  • Wacapew.CB
  • Wapomi.F
  • Zegost.M

Files Modified

File Attributes
\device\namedpipe\gmdasllogger Generic Write,Read Attributes
c:\program files\common files\system\symsrv.dll Generic Write,Read Attributes
c:\programdata\synaptics Synchronize,Write Attributes
c:\programdata\synaptics\rcx301f.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics\synaptics.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\programdata\synaptics\synaptics.exe Synchronize,Write Attributes
c:\programdata\synaptics\synaptics.exe Synchronize,Write Data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms Generic Read,Write Data,Write Attributes,Write extended,Append data
Show More
c:\users\user\appdata\local\temp\crm_modu.mod Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\dos_font.fon Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\exitframe.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\exitframe_mask.bmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\exitskin.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\framevorstellung.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\framevorstellung_hl.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\framevorstellung_mask.bmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\generell.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\icf.zip Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\install_hl.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\install_mask.bmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\installframe.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\instskin.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\lgw594f.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\temp\llkbljy.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mainskin.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nfoframe.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nfoframe_hl.jpg Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nfoframe_mask.bmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\nfoskin.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\pdx.x Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\vsda62e.tmp\install.log Generic Write,Read Attributes
c:\users\user\appdata\local\temp\winhqwag.exe Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\winhqwag.exe Generic Write,Read Attributes
c:\users\user\appdata\local\temp\winhqwag.exe Synchronize,Write Attributes
c:\users\user\appdata\local\temp\~df4079e401ecbca5f1.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~df5b76cbbd7f166093.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~df644eeca3e38399c0.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~df8215389a629b47e5.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\winsl Synchronize,Write Attributes
c:\users\user\appdata\roaming\winsl\l8\18\2026 Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_8817bec319b3c2241a00e5c6a679e147ba1f9e27_0001934336 Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_8817bec319b3c2241a00e5c6a679e147ba1f9e27_0001934336 Synchronize,Write Attributes
c:\users\user\downloads\csrv.exe Generic Write,Read Attributes
c:\users\user\downloads\ike.log Generic Write,Read Attributes
c:\users\user\downloads\ikecrash.log Generic Write,Read Attributes
c:\users\user\downloads\liblist.gam Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\liblist.gam Synchronize,Write Attributes
c:\users\user\downloads\temp\shsandbox-win32.dll-5.22.1.9999-x86.dmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\gupd.exe Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\windows\142a1 Generic Write,Read Attributes
c:\windows\20bc9d Generic Write,Read Attributes
c:\windows\system.ini Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\system32\drivers\etc\hosts Generic Write,Read Attributes
c:\windows\syswow64\bassmod.dll Generic Write,Read Attributes
c:\windows\syswow64\unace.dll Generic Write,Read Attributes
c:\windows\syswow64\unrar.dll Generic Write,Read Attributes

Registry Modifications

Key::Value Data API Name
HKCU\software\microsoft\windows\currentversion\run::gtalkupdate C:\Users\Qjhwyket\gupd.exe RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\096a6178c5c66bb2211219f2154b3a7bb467caee_0000048128.exe c:\users\user\downloads\096a6178c5c66bb2211219f2154b3a7bb467caee_0000048128.exe:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\84b5fb6e21b989d5cb26a708a2de33394c1d1bab_0000558592.exe c:\users\user\downloads\84b5fb6e21b989d5cb26a708a2de33394c1d1bab_0000558592.exe:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\a2aaae3d7fcbaaa3a84e2ba1d19becc6a2036825_0000109568 c:\users\user\downloads\a2aaae3d7fcbaaa3a84e2ba1d19becc6a2036825_0000109568:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\893f1a3d9f6bc6ec5ad22e16ca056cdea7a75712_0000561152 c:\users\user\downloads\893f1a3d9f6bc6ec5ad22e16ca056cdea7a75712_0000561152:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKCU\control panel\international::sshortdate dd/MM/yyyy RegNtPreCreateKey
HKCU\control panel\international::idate 0 RegNtPreCreateKey
HKCU\control panel\international::sdate / RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride  RegNtPreCreateKey
Show More
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify  RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications  RegNtPreCreateKey
HKCU\software\jguh::u1_0 啕啕 RegNtPreCreateKey
HKCU\software\jguh::u2_0 ᖍ RegNtPreCreateKey
HKCU\software\jguh::u3_0 権ă RegNtPreCreateKey
HKCU\software\jguh::u4_0 RegNtPreCreateKey
HKCU\software\jguh::u1_1 䴜㱃 RegNtPreCreateKey
HKCU\software\jguh::u2_1 書牥 RegNtPreCreateKey
HKCU\software\jguh::u3_1 ᥜ獦 RegNtPreCreateKey
HKCU\software\jguh::u4_1 獵牥 RegNtPreCreateKey
HKCU\software\jguh::u1_2 ꋏꁼ RegNtPreCreateKey
HKCU\software\jguh::u2_2  RegNtPreCreateKey
HKCU\software\jguh::u3_2 賃 RegNtPreCreateKey
HKCU\software\jguh::u4_2  RegNtPreCreateKey
HKCU\software\jguh::u1_3 婯䁹 RegNtPreCreateKey
HKCU\software\jguh::u2_3 俒地 RegNtPreCreateKey
HKCU\software\jguh::u3_3 ぶ嘳 RegNtPreCreateKey
HKCU\software\jguh::u4_3 婟地 RegNtPreCreateKey
HKCU\software\jguh::u1_4 鼭ⷤ RegNtPreCreateKey
HKCU\software\jguh::u2_4 Yؕ� RegNtPreCreateKey
HKCU\software\jguh::u3_4 ꟽ좖 RegNtPreCreateKey
HKCU\software\jguh::u4_4 췔즕 RegNtPreCreateKey
HKCU\software\jguh\1214104697::1919251317  RegNtPreCreateKey
HKCU\software\jguh\1214104697::-456464662 RegNtPreCreateKey
HKCU\software\jguh\1214104697::1462786655 RegNtPreCreateKey
HKCU\software\jguh\1214104697::-912929324  RegNtPreCreateKey
HKCU\software\jguh\1214104697::1006321993 K RegNtPreCreateKey
HKCU\software\jguh\1214104697::-1369393986 http://padrup.com/sobaka1.gifhttp://190.120.227.91:8080/sobak RegNtPreCreateKey
HKCU\software\jguh\1214104697::549857331 Uq�P�j�:�=?}�̀a�DYB'�g ���#�E��ɝ�ۢ������,fS�%���j���ĵ RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::appinit_dlls C:\PROGRA~1\COMMON~1\System\symsrv.dll RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::loadappinit_dlls  RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows nt\currentversion\windows::requiresignedappinit_dlls RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\f19387ffd62032495f10f6f11a94401279195d48_0000172032 c:\users\user\downloads\f19387ffd62032495f10f6f11a94401279195d48_0000172032:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\db993b231f0b348538a23bd6ca6acd219eaa3bfe_0000086528 c:\users\user\downloads\db993b231f0b348538a23bd6ca6acd219eaa3bfe_0000086528:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\a633a12d29892fbb2220c892c92b12a8d4c4eebe_0000054272 c:\users\user\downloads\a633a12d29892fbb2220c892c92b12a8d4c4eebe_0000054272:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\fonts::dos_font dos_font.fon RegNtPreCreateKey
HKCU\software\apcr\1214104697::1919251317 Û RegNtPreCreateKey
HKCU\software\apcr\1214104697::-456464662 RegNtPreCreateKey
HKCU\software\apcr\1214104697::1462786655 RegNtPreCreateKey
HKCU\software\apcr\1214104697::-912929324 # RegNtPreCreateKey
HKCU\software\apcr\1214104697::1006321993 é RegNtPreCreateKey
HKCU\software\apcr\1214104697::-1369393986 http://affiliate.free.rongrean.com/logo.gifhttp://demo.mosiva RegNtPreCreateKey
HKCU\software\apcr\1214104697::549857331 j�Փ�&�޿c��s���jS�+> �dya�6�{w��5_n(,"�)ǒ��=NZ ��H,z-? RegNtPreCreateKey
HKCU\software\apcr::u1_0 鱞댶 RegNtPreCreateKey
HKCU\software\apcr::u2_0 ⏑ RegNtPreCreateKey
HKCU\software\apcr::u3_0 権ă RegNtPreCreateKey
HKCU\software\apcr::u4_0 RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name 3f0e32e667afda4150c8c8ad9428b17dae6a8c10_0004874240 RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\explorer::maxlimit2 RBUZBSTYDS46014 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\dc9068fb96dd46fd3923c222eb71f4be7aa1089f_0000204288 c:\users\user\downloads\dc9068fb96dd46fd3923c222eb71f4be7aa1089f_0000204288:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\7d9f77dbe136f80568616da6a560d653e291797a_0000140800 c:\users\user\downloads\7d9f77dbe136f80568616da6a560d653e291797a_0000140800:*:enabled:@shell32.dll,-1 RegNtPreCreateKey
HKCU\software\jguh::u1_0 㣊ם RegNtPreCreateKey
HKCU\software\jguh::u2_0 ዀ RegNtPreCreateKey
HKCU\software\jguh::u1_1 娌쀟 RegNtPreCreateKey
HKCU\software\jguh::u2_1 婻牥 RegNtPreCreateKey
HKCU\software\jguh::u1_2 ꞗ펤 RegNtPreCreateKey
HKCU\software\jguh::u2_2 ﳳ RegNtPreCreateKey
HKCU\software\jguh::u1_3 ऱꨂ RegNtPreCreateKey
HKCU\software\jguh::u2_3 呅地 RegNtPreCreateKey
HKCU\software\jguh::u1_4 襪⬻ RegNtPreCreateKey
HKCU\software\jguh::u2_4 -ؕ� RegNtPreCreateKey
HKCU\software\jguh::u1_5 䍴Ⲻ RegNtPreCreateKey
HKCU\software\jguh::u2_5 尡㯻 RegNtPreCreateKey
HKCU\software\jguh::u3_5 ⭠㫸 RegNtPreCreateKey
HKCU\software\jguh::u4_5 䅉㯻 RegNtPreCreateKey
HKCU\software\jguh::u1_6 䅬䕜 RegNtPreCreateKey
HKCU\software\jguh::u2_6 钼깠 RegNtPreCreateKey
HKCU\software\jguh::u3_6 ��c� RegNtPreCreateKey
HKCU\software\jguh::u4_6 뒾깠 RegNtPreCreateKey
HKCU\software\jguh::u1_7 瓭嫀 RegNtPreCreateKey
HKCU\software\jguh::u2_7 ㈍⃆ RegNtPreCreateKey
HKCU\software\jguh::u3_7 䈚⇅ RegNtPreCreateKey
HKCU\software\jguh::u4_7 ⠳⃆ RegNtPreCreateKey
HKCU\software\jguh::u1_8 ὶ憐 RegNtPreCreateKey
HKCU\software\jguh::u2_8 贜錫 RegNtPreCreateKey
HKCU\software\jguh::u3_8 鈨 RegNtPreCreateKey
HKCU\software\jguh::u4_8 鮨錫 RegNtPreCreateKey
HKCU\software\jguh::u1_9 蛑ṡ RegNtPreCreateKey
HKCU\software\jguh::u2_9 ⽗֑ RegNtPreCreateKey
HKCU\software\jguh::u3_9 攴Ғ RegNtPreCreateKey
HKCU\software\jguh::u4_9 ༝֑ RegNtPreCreateKey
HKCU\software\jguh::u1_10 悿囋 RegNtPreCreateKey
HKCU\software\jguh::u2_10 鲆矶 RegNtPreCreateKey
HKCU\software\jguh::u3_10 盵 RegNtPreCreateKey
HKCU\software\jguh::u4_10 芒矶 RegNtPreCreateKey
HKCU\software\jguh::u1_11 ◝苂 RegNtPreCreateKey
HKCU\software\jguh::u2_11  RegNtPreCreateKey
HKCU\software\jguh::u3_11 鰮 RegNtPreCreateKey
HKCU\software\jguh::u4_11  RegNtPreCreateKey
HKCU\software\jguh::u1_12 ෺漫 RegNtPreCreateKey
HKCU\software\jguh::u2_12 粣峁 RegNtPreCreateKey
HKCU\software\jguh::u3_12 ͕巂 RegNtPreCreateKey
HKCU\software\jguh::u4_12 楼峁 RegNtPreCreateKey
HKCU\software\jguh::u1_13 枿읯 RegNtPreCreateKey
HKCU\software\jguh::u2_13 碌켦 RegNtPreCreateKey
HKCU\software\jguh::u3_13 뛘츥 RegNtPreCreateKey
HKCU\software\jguh::u4_13 ��&� RegNtPreCreateKey
HKCU\software\jguh::u1_14 하꘢ RegNtPreCreateKey
HKCU\software\jguh::u2_14 幾䆌 RegNtPreCreateKey
HKCU\software\jguh::u3_14 㩏䂏 RegNtPreCreateKey
HKCU\software\jguh::u4_14 偦䆌 RegNtPreCreateKey
HKCU\software\jguh::u1_15 깁 RegNtPreCreateKey
HKCU\software\jguh::u2_15 7�� RegNtPreCreateKey
HKCU\software\jguh::u3_15 ꧲닲 RegNtPreCreateKey
HKCU\software\jguh::u4_15 쏛돱 RegNtPreCreateKey
HKCU\software\jguh::u1_16 厀홍 RegNtPreCreateKey
HKCU\software\jguh::u2_16 ⊠♗ RegNtPreCreateKey
HKCU\software\jguh::u3_16 嵹❔ RegNtPreCreateKey
HKCU\software\jguh::u4_16 㝐♗ RegNtPreCreateKey
HKCU\software\jguh::u1_17 ꎚଙ RegNtPreCreateKey
HKCU\software\jguh::u2_17 눳颼 RegNtPreCreateKey
HKCU\software\jguh::u3_17 샬馿 RegNtPreCreateKey
HKCU\software\jguh::u4_17 ꫅颼 RegNtPreCreateKey
HKCU\software\jguh::u1_18 錅㧟 RegNtPreCreateKey
HKCU\software\jguh::u2_18 ঺ଢ RegNtPreCreateKey
HKCU\software\jguh::u3_18 琓ਡ RegNtPreCreateKey
HKCU\software\jguh::u4_18 Ḻଢ RegNtPreCreateKey
HKCU\software\jguh::u1_19 賜协 RegNtPreCreateKey
HKCU\software\jguh::u2_19 뢡綇 RegNtPreCreateKey
HKCU\software\jguh::u3_19 ﮆ粄 RegNtPreCreateKey
HKCU\software\jguh::u4_19 醯綇 RegNtPreCreateKey
HKCU\software\jguh::u1_20 㛡ﰂ RegNtPreCreateKey
HKCU\software\jguh::u2_20 ┢ RegNtPreCreateKey
HKCU\software\jguh::u3_20 漍 RegNtPreCreateKey
HKCU\software\jguh::u4_20 Ԥ RegNtPreCreateKey
HKCU\software\jguh::u1_21 뢰 RegNtPreCreateKey
HKCU\software\jguh::u2_21 橮扒 RegNtPreCreateKey
HKCU\software\jguh::u3_21 ኰ捑 RegNtPreCreateKey
HKCU\software\jguh::u4_21 碙扒 RegNtPreCreateKey
HKCU\software\jguh::u1_22 㲣＾ RegNtPreCreateKey
HKCU\software\jguh::u2_22 ﮎ풷 RegNtPreCreateKey
HKCU\software\jguh::u3_22 蘧햴 RegNtPreCreateKey
HKCU\software\jguh::u4_22 풷 RegNtPreCreateKey
HKCU\software\jguh::u1_23 鳆뮅 RegNtPreCreateKey
HKCU\software\jguh::u2_23 穈䜝 RegNtPreCreateKey
HKCU\software\jguh::u3_23 㖪䘞 RegNtPreCreateKey
HKCU\software\jguh::u4_23 徃䜝 RegNtPreCreateKey
HKCU\software\jguh::u1_24 ㅐ忛 RegNtPreCreateKey
HKCU\software\jguh::u2_24 쑁릂 RegNtPreCreateKey
HKCU\software\jguh::u3_24 룑뢁 RegNtPreCreateKey
HKCU\software\jguh::u4_24 틸릂 RegNtPreCreateKey
HKCU\software\jguh::u1_25 땏⿲ RegNtPreCreateKey
HKCU\software\jguh::u2_25 情⯨ RegNtPreCreateKey
HKCU\software\jguh::u3_25 ⱄ⫫ RegNtPreCreateKey
HKCU\software\jguh::u4_25 䙭⯨ RegNtPreCreateKey
HKCU\software\jguh::u1_26 ⾉᭰ RegNtPreCreateKey
HKCU\software\jguh::u2_26 깢鹍 RegNtPreCreateKey
HKCU\software\jguh::u3_26 폋齎 RegNtPreCreateKey
HKCU\software\jguh::u4_26 맢鹍 RegNtPreCreateKey
HKCU\software\jguh::u1_27 Ў君 RegNtPreCreateKey
HKCU\software\jguh::u2_27 㟾Ⴓ RegNtPreCreateKey
HKCU\software\jguh::u3_27 䝾ᆰ RegNtPreCreateKey
HKCU\software\jguh::u4_27 ⵗႳ RegNtPreCreateKey
HKCU\software\jguh::u1_28 뚱심 RegNtPreCreateKey
HKCU\software\jguh::u2_28 멪茘 RegNtPreCreateKey
HKCU\software\jguh::u3_28 쫥舛 RegNtPreCreateKey
HKCU\software\jguh::u4_28 ꃌ茘 RegNtPreCreateKey
HKCU\software\jguh::u1_29 覄瞘 RegNtPreCreateKey
HKCU\software\jguh::u2_29 㙈 RegNtPreCreateKey
HKCU\software\jguh::u3_29 繨 RegNtPreCreateKey
HKCU\software\jguh::u4_29 ᑁ RegNtPreCreateKey
HKCU\software\jguh::u1_30 垂ᤪ RegNtPreCreateKey
HKCU\software\jguh::u2_30 ꄞ柣 RegNtPreCreateKey
HKCU\software\jguh::u3_30 曠 RegNtPreCreateKey
HKCU\software\jguh::u4_30 螶柣 RegNtPreCreateKey
HKCU\software\jguh::u1_31 ^e�� RegNtPreCreateKey
HKCU\software\jguh::u2_31 ��H� RegNtPreCreateKey
HKCU\software\jguh::u3_31 �K� RegNtPreCreateKey
HKCU\software\jguh::u4_31 +�H� RegNtPreCreateKey
HKCU\software\jguh::u1_32 䭣偿 RegNtPreCreateKey
HKCU\software\jguh::u2_32 筿䲮 RegNtPreCreateKey
HKCU\software\jguh::u3_32 ҉䶭 RegNtPreCreateKey
HKCU\software\jguh::u4_32 溠䲮 RegNtPreCreateKey
HKCU\software\jguh::u1_33 뢯橁 RegNtPreCreateKey
HKCU\software\jguh::u2_33 ﯳ뼓 RegNtPreCreateKey
HKCU\software\jguh::u3_33 蠼븐 RegNtPreCreateKey

693 additional registry modifications are not displayed above.

Windows API Usage

Category API
Network Wininet
  • InternetOpen
  • InternetOpenUrl
  • InternetReadFile
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
  • OutputDebugString
Other Suspicious
  • AdjustTokenPrivileges
  • SetWindowsHookEx
User Data Access
  • GetComputerName
  • GetUserName
  • GetUserObjectInformation
Keyboard Access
  • GetAsyncKeyState
  • GetKeyState
Network Winsock2
  • WSAStartup
  • WSAttemptAutodialName
Process Manipulation Evasion
  • NtUnmapViewOfSection
  • ReadProcessMemory
Process Shell Execute
  • CreateProcess
  • ShellExecuteEx
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
Show More
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Service Control
  • OpenSCManager
Network Winhttp
  • WinHttpOpen
Network Winsock
  • bind
  • closesocket
  • gethostbyname
  • getsockname
  • socket

Shell Command Execution

C:\Users\Hnnkwzqe\AppData\Local\Temp\LgW594F.tmp c
c:\users\user\downloads\e19de81376582d8931ae933499e4428c8a445ef2_0000107520 -deleter
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fd8ba02dd123d8ae3929abd9ff64371783a5d280_0000454656.,LiQMAxHB
runas c:\users\user\downloads\._cache_8817bec319b3c2241a00e5c6a679e147ba1f9e27_0001934336
runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate