|
5/5
|
File System
|
Encrypts content of user files
|
Ransomware
|
|
-
Encrypts the content of multiple user files. This is an indicator for ransomware.
|
|
4/5
|
Injection
|
Writes into the memory of another running process
|
-
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\system32\sihost.exe"
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\system32\taskhostw.exe"
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\system32\runtimebroker.exe"
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe"
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe"
|
|
-
"c:\users\public\mksmd.exe" modifies memory of "c:\windows\system32\svchost.exe"
|
|
4/5
|
Injection
|
Modifies control flow of another process
|
-
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\system32\sihost.exe"
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\system32\taskhostw.exe"
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\system32\runtimebroker.exe"
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe"
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe"
|
|
-
"c:\users\public\mksmd.exe" creates thread in "c:\windows\system32\svchost.exe"
|
|
2/5
|
Anti Analysis
|
Delays execution
|
-
|
|
-
One thread sleeps more than 5 minutes.
|
|
2/5
|
Browser
|
Reads data related to browser cookies
|
-
|
|
-
Accesses Cookies for "Microsoft Internet Explorer".
|
|
2/5
|
File System
|
Known suspicious file
|
Trojan
|
|
-
File "C:\Users\CIiHmnxMn6Ps\Desktop\symnfa.exe" is a known suspicious file.
|
|
1/5
|
Process
|
Creates process with hidden window
|
-
|
|
-
The process "C:\users\Public\MKSMD.exe" starts with hidden window.
|
|
-
The process "net" starts with hidden window.
|
|
1/5
|
Process
|
Creates a page with write and execute permissions
|
-
|
|
-
Allocates a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
|
|
1/5
|
Anti Analysis
|
Resolves APIs dynamically
|
-
|
|
-
Resolves an unusually high number of APIs.
|
|
1/5
|
Masquerade
|
Changes folder appearance
|
Riskware
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
1/5
|
Persistence
|
Installs system startup script or application
|
-
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
1/5
|
File System
|
Creates an unusually large number of files
|
-
|
|
-
Creates an unusually large number of files.
|
|
1/5
|
PE
|
Drops PE file
|
Dropper
|
|
-
Drops file "C:\users\Public\MKSMD.exe".
|
|
1/5
|
PE
|
Executes dropped PE file
|
-
|
|
-
Executes dropped file "C:\users\Public\MKSMD.exe".
|
|
1/5
|
Process
|
Process crashed
|
-
|
|
-
Process "c:\windows\system32\sihost.exe" crashed.
|
|
-
Process "c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe" crashed.
|
|
-
Process "c:\windows\system32\taskhostw.exe" crashed.
|
|
-
Process "c:\windows\system32\runtimebroker.exe" crashed.
|
|
-
Process "c:\windows\system32\svchost.exe" crashed.
|
|
-
Process "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe" crashed.
|