Worm.Ramnit

By CagedTech in Worms

Published: January 19, 2023

Last updated: October 11, 2026

Threat Scorecard

Threat Level:	50 % (Medium)
Infected Computers:	65

First Seen:	November 12, 2010
Last Seen:	April 28, 2022
OS(es) Affected:	Windows

The detection of Worm.Ramnit on your system indicates a potential security threat that requires immediate attention. This report aims to provide you with a comprehensive understanding of the issue and guide you through the removal process. It is essential to address this threat promptly to prevent further damage to your system and protect your sensitive information.

What Is Worm.Ramnit?

Worm.Ramnit is a type of malware that can infect your computer without your knowledge or consent. Malware, short for malicious software, refers to any program or code designed to harm or exploit a computer system. The term "worm" specifically indicates that this malware can replicate itself and spread to other systems without the need for human interaction, such as opening an email attachment or clicking on a link.

How Worm.Ramnit Operates

Malware like Worm.Ramnit typically operates by exploiting vulnerabilities in software or using social engineering tactics to trick users into installing it. Once installed, it can perform a variety of malicious actions, including stealing sensitive information, altering system settings, and spreading to other computers. Worms are particularly dangerous because they can spread rapidly across a network, causing widespread damage and disruption.

They can infect other computers through network connections, making them a significant threat to both personal and corporate networks.
Malware can also download additional malicious software onto your computer, leading to further complications and security risks.
Moreover, worms can open backdoors on your system, allowing remote access to hackers, which can lead to identity theft, financial loss, and other serious consequences.

Symptoms of Infection

Identifying a malware infection can be challenging, as symptoms may not always be apparent. However, common signs include slow system performance, frequent crashes, and unfamiliar programs or icons on your computer. You might also notice unusual network activity or find that your antivirus software is disabled. Being vigilant and regularly monitoring your system's behavior can help in early detection of such threats.

How to Remove Worm.Ramnit

First, restart your computer in Safe Mode with Networking. This will limit the malware's ability to interfere with the removal process and allow you to download necessary tools.
Next, perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated to the latest version to maximize its effectiveness against current threats.
Uninstall any suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only remove programs you are certain are not essential to your system's operation.
Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings. This can help remove any malicious extensions or settings changes made by the malware.
Finally, reboot your computer and perform another scan to ensure that the malware has been completely removed. Regularly scanning your system and keeping your software up to date can help prevent future infections.

Conclusion

The removal of Worm.Ramnit requires careful steps to ensure that the malware is completely eradicated from your system. By following the guidance provided and maintaining good cybersecurity practices, you can protect your computer and personal data from malware threats. Remember, prevention is key; keeping your operating system, software, and antivirus tools updated, along with being cautious when opening emails or downloading files from the internet, can significantly reduce the risk of malware infections.

File System Details

Worm.Ramnit may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	$R1PTAK7.exe	ce99b549382dbfc4f41efe99b5dbcd54	29
Name: $R1PTAK7.exe MD5: ce99b549382dbfc4f41efe99b5dbcd54 Size: 53.76 KB (53760 bytes) Detections: 29 Type: Executable File Path: J:\$Recycle.Bin\S-1-5-21-4280012986-1309315051-253067505-1000\$R1PTAK7.exe Group: Malware file Last Updated: February 23, 2023
2.	rundll32srv.exe	e79f2388f25b81d3544c861fb99acd23	2
Name: rundll32srv.exe MD5: e79f2388f25b81d3544c861fb99acd23 Size: 69.63 KB (69632 bytes) Detections: 2 Type: Executable File Path: %WINDIR%\system32 Group: Malware file Last Updated: November 12, 2010
3.	desktoplayer.exe	fbf3d2e793ee27f19e15b791ee867c62	1
Name: desktoplayer.exe MD5: fbf3d2e793ee27f19e15b791ee867c62 Size: 41.98 KB (41984 bytes) Detections: 1 Type: Executable File Path: %PROGRAMFILES%\microsoft Group: Malware file Last Updated: November 12, 2010

More files

Analysis Report

General information

Family Name:	Virus.Ramnit
Signature status:	No Signature

Known Samples

MD5: f305e5a2ff175bf983884368839116fa

SHA1: e36ec4af9138c68e6476550bbbec5d48ab1aed62

File Size: 3.35 MB, 3348992 bytes

MD5: 742e7d98a7f49e08628df00aef522641

SHA1: d8231479b45354fd1fb2493a3191c9cde37eeb1e

File Size: 94.72 KB, 94720 bytes

MD5: bb5f75fdde57f5829a402e184bfaf5c9

SHA1: cbb3468b047cdd428e973f39d04907c6e6cd22d6

SHA256: CC7CBFE42D5D1D8AB5F677BAEEB2E70B672B06A01D78FB0D76F2147B879202B4

File Size: 908.80 KB, 908800 bytes

MD5: c5bf3a8e7d5d659dd863af243f8e0028

SHA1: 563ec51c5d0eb06f04296b4ffd97de6968c8a286

SHA256: DB2FF4A37B3B5BC0B0B916B53D4CC74489A24D8F356D738307D4669005472003

File Size: 128.51 KB, 128512 bytes

MD5: bbd7303565715bd5a70aca166e5d1008

SHA1: 85274b3a3f2b4c1dd9bd08d3e525c264554f9df0

SHA256: 29B80D0D1B16D71BDE0BCBF992CB9E8841B7C14B6AA523B4E39521F74D2C470D

File Size: 8.91 MB, 8906131 bytes

MD5: 23f4ea05999cef1b072cd29d3f7b2985

SHA1: c2c1196513d90e862de8c658349e197ed55ba71f

SHA256: 0F0064777BF29B845B22816D96A73D34E5E565E463E2676AA279D33F305787C7

File Size: 419.84 KB, 419840 bytes

MD5: 15fad0087fa950670d11ad23ea286c5f

SHA1: caba7f5c2d46d5b1a6f3cbb3e1c10e9bae7ef8b1

SHA256: 7B6386448B0DE1196DBDBB9C1444458302D4B5654AE96D99303D1FABBF2457A2

File Size: 3.55 MB, 3547136 bytes

MD5: 47774d335319a79a5062f8f8105c13ab

SHA1: e2d5b432e6634e84c289534ff0e529dbac5e06a4

SHA256: 4F239DC9D2F5AA842B3D24DE939A17D64F09B71084A68E3D3E3B7A630DF152B6

File Size: 167.94 KB, 167936 bytes

MD5: 1a6da5e5f2c5a31c016f965f5d4a3646

SHA1: 50623038165328fa063e5792efc036cd043c8061

SHA256: 61BC845F599F5BB0A6636AB8FA8C41FE68BA4104AA79325715834DD9DB2F881D

File Size: 2.40 MB, 2400104 bytes

MD5: ed7083abd0308bc8fe598094d34692c1

SHA1: 00c8ff728d2290e9378a6d61bdabb4f134abb087

SHA256: C377AF25CD6FF1EDD2191F3E54EE3A15F87B8BB3F9FC7E20DDD1C4F5D7B43443

File Size: 2.38 MB, 2380631 bytes

MD5: a54cc533634f5c11a5482dcd111afd49

SHA1: 94d05772a2f011cc9376ed5886b0d4ff04bd57c0

SHA256: 8D6CF93E7082F1B3B1739FC584131B96058B537BB66D03C58BCBF1C5C6A52610

File Size: 6.58 MB, 6578176 bytes

MD5: 833ecba7a10684d834f651affc86ae67

SHA1: 4981f7ff076e61f1f04c4bb2e5754333721dc154

SHA256: 4492762BD38EA5399E5FA4C7EB232996A41EC6D0BD51A5A189515E5B45F140A8

File Size: 2.21 MB, 2211328 bytes

MD5: cf99fdafe133a55641aca8ccd84b3b8b

SHA1: 82927e5a6116fd826eb80d14a29cd0b81a24f8f5

SHA256: 5133802B8898F9F05F28DE8D3A687CF9D2440F6FF0B45B5413DB7ACD2C8427D7

File Size: 507.90 KB, 507904 bytes

MD5: 65cdbdce1c3d5127bef9a1b76db1c9ce

SHA1: 6f0b8eb4a3b208e18fe80cfea801406ba09d6f86

SHA256: 655B1B7104BE2A6474F8B035B8C2804796051B8255094ADD1D21C731C5D2DD0A

File Size: 6.65 MB, 6646146 bytes

MD5: eb3f0c1fd02bad98f8c1e6fac3c2cf06

SHA1: b4f9b5f5d10744c2cc4418daea0885614e5246a5

SHA256: 3F604CEEC7912FF7D4177350521F6CD7ABB72999700A563E53E36058A14C21AA

File Size: 204.29 KB, 204288 bytes

MD5: fed5d78d09ccc6dfef0965e352c8fb87

SHA1: 73cbac9348e66b9881912a82b48178131a06cb28

SHA256: 7D8CB5D83618BF90E696025FEDE551865132ABA29C5666D98B8D8D281881BF33

File Size: 116.69 KB, 116689 bytes

MD5: c11735a786f558287256e4488fc7ddb7

SHA1: 11b0c2802991ebb46efbc0fa38f002f010b8abe4

SHA256: 3E68B574C950C29D66F7080AD67007C837EF5EA973630952F037451097BD4288

File Size: 172.03 KB, 172032 bytes

MD5: 853a028b6dbde866cf1e4bf73b6e5888

SHA1: 670295249f654afb56088f156c2ff018c4adb477

SHA256: D2C0BC26A6424794A9226BEC1D5C92221F5969920214B3281A85D5F08D01AC61

File Size: 222.62 KB, 222622 bytes

MD5: 108e6cd477cfa8ab662c489f608446a8

SHA1: 6f0665a8446c6578b3c613e63609e26bb8797707

SHA256: D47C8E39AA6DC3E835CB15DD609EB714B9A9A7E9A99672CA7056626142D76CC0

File Size: 8.53 MB, 8533342 bytes

MD5: 9bb2a2fa7924ba685ef3c7228e3c80ad

SHA1: ee3cea661b3b62bab75d4ee3c319cb18b0fb8c42

SHA256: C4CB1C0093244F9D2DE23CC7584D339C5BB7858B9294E68EBA44D35F42D19C74

File Size: 5.32 MB, 5323092 bytes

MD5: 04b83d7141e9be12ab6f4780579e116b

SHA1: 0d86051102614d665d092c3d5f6981358c541040

SHA256: 4CB817DA72CAD9E8CB36D82EA9371EC3321F48D31C7E88B89C2157B8F8FE0FBF

File Size: 303.10 KB, 303104 bytes

MD5: aa41d816b04905c9cc37ddff3eeaaee0

SHA1: 1edd43ff52bbbe91c6ba71c86219639871ff0a48

SHA256: 8AC2C91F52C5DFE20B88B5EA014B74D500D8CAC16555F95CF8DBC1C6AFA68042

File Size: 114.18 KB, 114176 bytes

MD5: e69208037bc4cc21a17c2dc30e9ae299

SHA1: ce0c909c7138e04073dc151772631e8ee16627ea

SHA256: 7E7BE5F89FA7AB2168EACB0782E6FD3019D0102F936387C34CFDD79A0A5840CE

File Size: 94.21 KB, 94208 bytes

MD5: dd41c743b3899c6dff4f5d08238ef62b

SHA1: b87207bbbb558505e2996c7dacf51cb7bcceafad

SHA256: 403EDCF11F12EA15912FD503A29FF7F4577B76F5FCF1B63BC42029F1130BA317

File Size: 114.18 KB, 114176 bytes

MD5: 9b28c0c60a225f40beaecaa7632910a1

SHA1: 86712992d256eb16139f6e69ba03658d681a0c55

SHA256: BC24F7412F517C272B0C8CF299D45A318674F328E103DE6E4A746D64E5B46512

File Size: 143.36 KB, 143360 bytes

MD5: 5e5cd1de75887508801c7acd00957bc3

SHA1: f1bb864d5bc5e51f82b73831c28808fcc7e975da

SHA256: A0EEB541433346A1EC57A337203E172BBBD798BB9F6FEAEEE237AAF91B9C78AD

File Size: 1.53 MB, 1526784 bytes

MD5: 4228004b0888571e50afe80c1990444b

SHA1: eb24dd1105a5077ef411874d95d0471d7a0ac39c

SHA256: FB801AB47093C4E1D48EB5D06A5B9BFFD35F71C30599A824C572D20D263566A0

File Size: 1.52 MB, 1515520 bytes

MD5: f2a46efa385959078e5e2d14ef1d7954

SHA1: 35d9ccc94e731b9a3463277fdd5eca57a08f2a11

SHA256: 2EED8701E14BE4FA3A6227CB81AFBA06C06530D00FDA3887CA7A0E40CDB0BE52

File Size: 1.38 MB, 1376768 bytes

MD5: f9eb5b12f650f18e804678ffb8227473

SHA1: a7dd171716ca02788db158ba91c6c7ad7e165b2c

SHA256: E96273BD8A619BF23C8D09C140F18E18D2803C6D85B83D49DF343FFEAB226A1A

File Size: 120.80 KB, 120798 bytes

MD5: 07b4a2d6f5a226c0252cb8a8302563e2

SHA1: c174e174c3e55208e67e523307e0cd3b2c7aa4da

SHA256: C2FC9852CD8B1148F5A5B4779E367077180381CEB30A1D115EB9CBD937BB0E96

File Size: 56.97 KB, 56973 bytes

MD5: ead7c01570d539c4bfd926cf57ea627c

SHA1: a944343de9f0b6514c5bfb7ca9ac7cb5820d15a5

SHA256: 781656FB8CD0E32A6D735C11E24D280BDD7528E63AC10791C5B960095F54E6D7

File Size: 187.90 KB, 187904 bytes

MD5: 0bad093f64e01aff66b71a508a9dfb2a

SHA1: 8990a0c86c37c802d865c7343de5cd01b637095e

SHA256: E1829343CAC5E812C8FD37A608AF18DC46F5DB7CB72A2E471E691EEC0B46E7E5

File Size: 428.00 KB, 428005 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have resources
File doesn't have security information
File has been packed
File has exports table
File has TLS information
File is 32-bit executable

File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
File is either console or GUI application
File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Comments	Created with AutoPlay Media Studio Elder Scrolls 3 GUI Version
Company Name	Bethesda Softworks C-Media Electronics Inc. CANON INC. EZB Systems, Inc. FTDI Ltd. Hewlett-Packard Company Inprise Corporation Microsoft Corporation Nero AG Nokia Corporation and/or its subsidiary(-ies) Show More SOFTWIN S SOFTWIN S.R.L. Synaptics The OpenSSL Project, https://www.openssl.org/
File Description	AutoPlay Application BitDefen BitDefender Antispam Dispatcher Plugin C++ application development framework. Canon IJ Printer Assistant Tool Dynamic Link Run Time Library (VCL MT) Español by rade FTBUSUI Property Page Provider ISOShell Morrowind Launcher Show More Nero Home OpenSSL library SmartWizard MFC Application SwiftShader libGLESv2 32-bit Dynamic Link Library Synaptics Pointing Device Driver vaporware bak lanz lanz ertl ertl whoppers lanz ertl Nelsons Heartily adulthood Agriculturists vaporware bak lanz lanz ertl ertl whoppers lanz ertl Nelsons Heartily adulthood Agriculturists vaporware bak lanz lanz ertl ertl whoppers lanz ertl Nelsons Heartily adulthood Agriculturists vaporware bak lanz lanz ertl ertl whoppers lanz ertl Nelsons Heartily adulthood Agriculturists Win32 Cabinet Self-Extractor Windows Easy Transfer 添加ARP Microsoft 基础类应用程序
File Version	106.42.73 8.5.0.0 6.2.9200.16384 (win8_rtm.120725-1247) 6.00.3790.0 (srv03_rtm.030324-2048) 5.9.1.192 4.50.0000 4.7.1.0 3.3.0.1 2, 5, 1, 0 2, 0, 6, 0 Show More 1.1.1d 1.05.2.10 1.0.0.5 1.0.0.4 1, 5, 13, 0 1, 0, 1, 9 1, 0, 0, 2 1, 0, 0, 1
Internal Name	ams_runtime Antispam Dispatcher Plugin CNMPAUI.DLL FTBUSUI.dll HPUSBFW ISOShell libcrypto libGLESv2 Morrowind Launcher NMIndexingServicePS Show More Run Time Library SmartWizard wet.dll Wextract фжзрюкшэщ 添加ARP
Legal Copyright	2528-6 Copyright (c) 1995-2006 Nero AG and its licensors Copyright (C) 2003 Copyright (c) 2006-2007 EZB Systems, Inc. Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies). Copyright (C) 2016 Google Inc. Copyright 1998-2019 The OpenSSL Authors. All rights reserved. Copyright CANON INC. 2017 Copyright Inprise Corporation 1994,1999 Copyright © 2001 Show More Copyright © 2003-2004 Hewlett-Packard Development Company, L.P. All rights reserved. Copyright © 2006 FTDI Ltd. Runtime Engine Copyright © 2015 Indigo Rose Corporation (www.indigorose.com) Surpluses © 2004-2007 SOFTWIN S.R.L. © Microsoft Corporation. All rights reserved. 版权所有 (C) 2012
Legal Trademarks	AutoPlay Media Studio is a Trademark of Indigo Rose Corporation
Original Filename	ams_runtime.exe asemldsp.mdl CNMPAUI.DLL FTBUSUI.dll HPUSBFW.exe ISOShell.DLL libcrypto libGLESv2.dll Morrowind Launcher nedwp Show More NMIndexingServicePS.dll QtGui4.dll SmartWizard.EXE Surpluses wet.dll WEXTRACT.EXE 添加ARP.EXE
Private Build	3.3.0.1 Jan 21, 2004 Build 006
Product Name	AutoPlay Media Studio Runtime Bethesda Softworks Morrowind Launcher BitDefender Borland C++ Builder 4.0 Canon IJ Printer Assistant Tool FTDIChip CDM Drivers HP USB Disk Storage Format Tool ISOShell Microsoft® Windows® Operating System Nero Home Show More Qt4 SmartWizard Application Surpluses SwiftShader libGLESv2 Dynamic Link Library Synaptics Pointing Device Driver The OpenSSL Toolkit люзанх 添加ARP 应用程序
Product Version	106.4 8.5.0.0 6.2.9200.16384 6.00.3790.0 5.9.1.192 4.5 3.3.0.1 2.00.00.1 2, 5, 1, 0 2, 0, 6, 0 Show More 1.1.1d 1.05.2.10 1.0.0.0 1, 5, 13, 0 1, 0, 1, 9 1, 0, 0, 2 1, 0, 0, 1

File Traits

.adata
2+ executable sections
AMS
dll
HighEntropy
imgui
No Version Info
ntdll
packed
PEC2

upx
UPX!
x64
x86

Block Information

Total Blocks:	599
Potentially Malicious Blocks:	14
Whitelisted Blocks:	485
Unknown Blocks:	100

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 ? ? 0 ? ? 0 ? ? ? 0 0 0 0 ? ? 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 ? ? 0 0 ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? 0 0 ? 0 ? ? ? 0 0 0 ? 0 ? ? ? 0 ? 0 ? ? 0 0 ? ? ? 0 0 0 0 ? 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? 0 ? ? ? ? ? 0 ? 0 ? ? ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 1 1 0 0 0 0 0 0 0 1 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 1 0 1 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 1 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 x x x x x x x x x x x x x x

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Agent.IFSB
Agent.NYA
Delf.BP
Gamehack.ODB
Kraddare.OC

Kryptik.DGE
Ramnit.V
Rugmi.RC
Trojan.Agent.Gen.UZ
Trojan.Downloader.Gen.GN
Trojan.Downloader.Gen.JA
Ulise.A
Wabot.D
ZBot.NA
ZBot.NB
Zbot.N
Zzinfor.C

Files Modified

File	Attributes
\device\harddisk0\dr0	Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics	Synchronize,Write Attributes
c:\programdata\synaptics\rcx4b1a.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics\synaptics.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Attributes
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Data

c:\users\user\appdata\local\temp\faqpllf.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\hmxtkl.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\hmxtkl.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\hmxtkl.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdcleaner.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdcleaner.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdcleaner.exe_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdguictl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdguictl.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdguictl.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdutils.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\bdutils.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_activ.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_activ.ico	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_activ.ico_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_grey.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_grey.ico	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_grey.ico_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_normal.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_normal.ico	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\button_normal.ico_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\config.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\config.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\config.xml_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\mfc80u.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\mfc80u.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\mfc80u.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.crt.manifest	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.crt.manifest	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.crt.manifest_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.mfc.manifest	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.mfc.manifest	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\microsoft.vc80.mfc.manifest_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcp80.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcp80.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcp80.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcr80.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcr80.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\msvcr80.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\rm_shrct.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\rm_shrct.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\rm_shrct.exe_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\skin.xml	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\skin.xml	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\skin.xml_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\snetcfg.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\snetcfg.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\snetcfg.exe_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\tmp4351$.tmp	Generic Write,Read Attributes,Delete
c:\users\user\appdata\local\temp\ixp000.tmp\txmlx.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\txmlx.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\txmlx.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.exe_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\uninstalltool.ini_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_large_caption.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_large_caption.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_large_caption.bmp_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_msgbox.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_msgbox.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\ixp000.tmp\wnd_msgbox.bmp_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nslcbb0.tmp\nsexec.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\~tma36e.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\winsl	Synchronize,Write Attributes
c:\users\user\appdata\roaming\winsl\l7\30\2026	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_35d9ccc94e731b9a3463277fdd5eca57a08f2a11_0001376768	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_35d9ccc94e731b9a3463277fdd5eca57a08f2a11_0001376768	Synchronize,Write Attributes
c:\users\user\downloads\cmgr.exe	Generic Write,Read Attributes
c:\users\user\downloads\csrv.exe	Generic Write,Read Attributes
c:\users\user\downloads\csrvsrv.exe	Generic Write,Read Attributes
c:\users\user\downloads\e36ec4af9138c68e6476550bbbec5d48ab1aed62_0003348992srv.exe	Generic Write,Read Attributes
c:\users\user\downloads\temp\shsandbox-win32.dll-5.21.4.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\temp\shsandbox-win32.dll-5.22.1.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\temp\shsandbox-win32.dll-5.23.1.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\2ca2e1	Generic Write,Read Attributes
c:\windows\system.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\rundll32mgr.exe	Generic Write,Read Attributes
c:\windows\syswow64\rundll32srv.exe	Generic Write,Read Attributes
c:\windows\syswow64\temp\shsandbox-win32.dll-5.22.1.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\temp\shsandbox-win32.dll-5.23.1.9999-x86.dmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey

HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\direct3d\mostrecentapplication::name	caba7f5c2d46d5b1a6f3cbb3e1c10e9bae7ef8b1_0003547136	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey
HKCU\software\jguh::u1_0	啕啕	RegNtPreCreateKey
HKCU\software\jguh::u2_0	ᖍ	RegNtPreCreateKey
HKCU\software\jguh::u3_0	権ă	RegNtPreCreateKey
HKCU\software\jguh::u4_0		RegNtPreCreateKey
HKCU\software\jguh::u1_1	䴜㱃	RegNtPreCreateKey
HKCU\software\jguh::u2_1	書牥	RegNtPreCreateKey
HKCU\software\jguh::u3_1	ᥜ獦	RegNtPreCreateKey
HKCU\software\jguh::u4_1	獵牥	RegNtPreCreateKey
HKCU\software\jguh::u1_2	ꋏꁼ	RegNtPreCreateKey
HKCU\software\jguh::u2_2		RegNtPreCreateKey
HKCU\software\jguh::u3_2	賃	RegNtPreCreateKey
HKCU\software\jguh::u4_2		RegNtPreCreateKey
HKCU\software\jguh::u1_3	婯䁹	RegNtPreCreateKey
HKCU\software\jguh::u2_3	俒地	RegNtPreCreateKey
HKCU\software\jguh::u3_3	ぶ嘳	RegNtPreCreateKey
HKCU\software\jguh::u4_3	婟地	RegNtPreCreateKey
HKCU\software\jguh::u1_4	鼭ⷤ	RegNtPreCreateKey
HKCU\software\jguh::u2_4	Yؕ�	RegNtPreCreateKey
HKCU\software\jguh::u3_4	ꟽ좖	RegNtPreCreateKey
HKCU\software\jguh::u4_4	췔즕	RegNtPreCreateKey
HKCU\software\jguh::u1_5	綁ׂ	RegNtPreCreateKey
HKCU\software\jguh::u2_5	哄㯻	RegNtPreCreateKey
HKCU\software\jguh::u3_5	⭠㫸	RegNtPreCreateKey
HKCU\software\jguh::u4_5	䅉㯻	RegNtPreCreateKey
HKCU\software\jguh::u1_6	ⷨ𢡄	RegNtPreCreateKey
HKCU\software\jguh::u2_6	ꄳ깠	RegNtPreCreateKey
HKCU\software\jguh::u3_6	��c�	RegNtPreCreateKey
HKCU\software\jguh::u4_6	뒾깠	RegNtPreCreateKey
HKCU\software\jguh::u1_7	穠峕	RegNtPreCreateKey
HKCU\software\jguh::u2_7	㶾⃆	RegNtPreCreateKey
HKCU\software\jguh::u3_7	䈚⇅	RegNtPreCreateKey
HKCU\software\jguh::u4_7	⠳⃆	RegNtPreCreateKey
HKCU\software\jguh::u1_8	騍橎	RegNtPreCreateKey
HKCU\software\jguh::u2_8	踥錫	RegNtPreCreateKey
HKCU\software\jguh::u3_8	鈨	RegNtPreCreateKey
HKCU\software\jguh::u4_8	鮨錫	RegNtPreCreateKey
HKCU\software\jguh::u1_9	驄깽	RegNtPreCreateKey
HKCU\software\jguh::u2_9	᪐֑	RegNtPreCreateKey
HKCU\software\jguh::u3_9	攴Ғ	RegNtPreCreateKey
HKCU\software\jguh::u4_9	༝֑	RegNtPreCreateKey
HKCU\software\jguh::u1_10	옯쟌	RegNtPreCreateKey
HKCU\software\jguh::u2_10	鷺矶	RegNtPreCreateKey
HKCU\software\jguh::u3_10	盵	RegNtPreCreateKey
HKCU\software\jguh::u4_10	芒矶	RegNtPreCreateKey
HKCU\software\jguh::u1_11	䡖騅	RegNtPreCreateKey
HKCU\software\jguh::u2_11		RegNtPreCreateKey
HKCU\software\jguh::u3_11	鰮	RegNtPreCreateKey
HKCU\software\jguh::u4_11		RegNtPreCreateKey
HKCU\software\jguh::u1_12	ጱ	RegNtPreCreateKey
HKCU\software\jguh::u2_12	稠峁	RegNtPreCreateKey
HKCU\software\jguh::u3_12	͕巂	RegNtPreCreateKey
HKCU\software\jguh::u4_12	楼峁	RegNtPreCreateKey
HKCU\software\jguh::u1_13	摂	RegNtPreCreateKey
HKCU\software\jguh::u2_13	왕켦	RegNtPreCreateKey
HKCU\software\jguh::u3_13	뛘츥	RegNtPreCreateKey
HKCU\software\jguh::u4_13	��&�	RegNtPreCreateKey
HKCU\software\jguh::u1_14	ᚿ쳲	RegNtPreCreateKey
HKCU\software\jguh::u2_14	䖘䆌	RegNtPreCreateKey
HKCU\software\jguh::u3_14	㩏䂏	RegNtPreCreateKey
HKCU\software\jguh::u4_14	偦䆌	RegNtPreCreateKey
HKCU\software\jguh\1214104697::1919251317		RegNtPreCreateKey
HKCU\software\jguh\1214104697::-456464662		RegNtPreCreateKey
HKCU\software\jguh\1214104697::1462786655		RegNtPreCreateKey
HKCU\software\jguh\1214104697::-912929324		RegNtPreCreateKey
HKCU\software\jguh\1214104697::1006321993	K	RegNtPreCreateKey
HKCU\software\jguh\1214104697::-1369393986	http://padrup.com/sobaka1.gifhttp://190.120.227.91:8080/sobak	RegNtPreCreateKey
HKCU\software\jguh\1214104697::549857331	Uq�P�j�:�=?}�̀a�DYB'�g ��#�E��ɝ�ۢ��,fS�%��j��ĵ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	➅핯飡ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list::c:\users\user\downloads\b4f9b5f5d10744c2cc4418daea0885614e5246a5_0000204288	c:\users\user\downloads\b4f9b5f5d10744c2cc4418daea0885614e5246a5_0000204288:*:enabled:@shell32.dll,-1	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m �v��%�1�@V�a$�$��B1_�i�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m �v��%�1�@V�a$e�v�$��B1_�i�	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::wextract_cleanup0	rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Rzgifumu\AppData\Local\Temp\IXP000.TMP\"	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m �v��%�,=�1�@V�N�a$e�vy�9�$��B1_�i�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m �v��%�,=�1�@V�N�a$e�vy�9�$��B1_�i��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m �v ��%�,=�1�@V�N�a$e�vy�9�$��B1_�i��	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00��Gs]XM��"�2��FXD�':D��exA-�b�jYҴB�t�� S�	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00��Gs]XM��"�2��FX]T�� B��wȝb�jYҴB�t�� S�	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00��Gs]XM��"�2��FX��n��<��b�jYҴB�t�� S�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n �v��(�1`1�1HO@V�_�zb"hk`k�ql(�{b��P��m�Ù��$�8წ��V�=�SB1_T�Vw��%��AE��D��&��$��L	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver	C:\ProgramData\Synaptics\Synaptics.exe	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00��Gs]XM��"�2��FX��n��<��D�':D��exA-8	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n �v��(�1`1�1HO@V�_�zb"hk`k�ql(�w�n{b��P��m�Ù��$�8წ��V�=�SB1_T�Vw��%��AE��D��&��$��L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n �v��(�1`1�1HO@V�_�zb"hk`k�ql(�w�n{b��P��m�Ù��$�8წ��V�=�SB1_T�Vw��%��AE��D��&��$��L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	鴲ȁ獖}	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n$ �v��(�1`1�1HO@V�_�zb"hk`k�ql(�w�n{b��P��7�M��m�Ù��IV��$�8წ��V�(!��j��=�SB1_T�Vw�`�V��%��AE��D��&��$��L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n% �v��(�1`1�1HO@V�_�zb"hk`k�ql(�r�7w�n{b��P��7�M��m�Ù��IV��$�8წ��V�(!��j��=�SB1_T�Vw�`�V��%��AE��D��&��$��L	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n% �v��(�1`1�1HO@V�_�zb"hk`k�ql(�r�7w�n{b��P��7�M��m�Ù��IV��$�8წ��V�(!��j��=�SB1_T�Vw�`�V�R��%��AE��D��&��$��L	RegNtPreCreateKey

Windows API Usage

Category	API
Process Shell Execute	CreateProcess ShellExecuteEx
Encryption Used	CryptAcquireContext
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtProtectVirtualMemory Show More ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetThreadState
Anti Debug	IsDebuggerPresent NtQuerySystemInformation OutputDebugString
Process Manipulation Evasion	NtUnmapViewOfSection ZwMapViewOfSection
User Data Access	GetUserObjectInformation
Service Control	OpenSCManager
Network Winsock2	WSAStartup WSAttemptAutodialName
Network Winhttp	WinHttpOpen
Network Wininet	InternetOpen InternetOpenUrl InternetReadFile
Network Winsock	bind closesocket gethostbyname getsockname socket

Shell Command Execution


							c:\users\user\downloads\e36ec4af9138c68e6476550bbbec5d48ab1aed62_0003348992Srv.exe


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\cbb3468b047cdd428e973f39d04907c6e6cd22d6_0000908800.,LiQMAxHB


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\85274b3a3f2b4c1dd9bd08d3e525c264554f9df0_0008906131.,LiQMAxHB


							cSrv.exe


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\e2d5b432e6634e84c289534ff0e529dbac5e06a4_0000167936.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\50623038165328fa063e5792efc036cd043c8061_0002400104.,LiQMAxHB


									cmgr.exe


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4981f7ff076e61f1f04c4bb2e5754333721dc154_0002211328.,LiQMAxHB


									powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Vifibodj\AppData\Local\""


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\73cbac9348e66b9881912a82b48178131a06cb28_0000116689.,LiQMAxHB


									c:\users\user\downloads\cSrvSrv.exe


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6f0665a8446c6578b3c613e63609e26bb8797707_0008533342.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ee3cea661b3b62bab75d4ee3c319cb18b0fb8c42_0005323092.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ce0c909c7138e04073dc151772631e8ee16627ea_0000094208.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\86712992d256eb16139f6e69ba03658d681a0c55_0000143360.,LiQMAxHB


									C:\Users\Rzgifumu\AppData\Local\Temp\IXP000.TMP\UninstallTool.exe


									runas c:\users\user\downloads\._cache_35d9ccc94e731b9a3463277fdd5eca57a08f2a11_0001376768


									runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a7dd171716ca02788db158ba91c6c7ad7e165b2c_0000120798.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c174e174c3e55208e67e523307e0cd3b2c7aa4da_0000056973.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a944343de9f0b6514c5bfb7ca9ac7cb5820d15a5_0000187904.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8990a0c86c37c802d865c7343de5cd01b637095e_0000428005.,LiQMAxHB

Worm.Ramnit

Threat Scorecard

EnigmaSoft Threat Scorecard

What Is Worm.Ramnit?

How Worm.Ramnit Operates

Symptoms of Infection

How to Remove Worm.Ramnit

Conclusion

File System Details

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

File Traits

Block Information

Block Information

Visual Map

Similar Families

Similar Families

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed