|
5/5
|
Device
|
Writes to Master Boot Record (MBR)
|
-
|
|
-
Writes 512 bytes to master boot record (MBR).
|
|
4/5
|
OS
|
Modifies Windows automatic backups
|
-
|
|
-
Deletes Windows volume shadow copies.
|
|
4/5
|
File System
|
Associated with malicious files
|
Trojan
|
|
-
File "c:\users\5jghkoaofdp\desktop\3c7d9ecd35b21a2a8fac7cce4fdb3e11c1950d5a02a0c0b369f4082acf00bf9a.exe" is a known malicious file.
|
|
1/5
|
File System
|
Modifies operating system directory
|
-
|
|
-
Creates file "C:\Windows\svchost.exe" in the OS directory.
|
|
1/5
|
Persistence
|
Installs system startup script or application
|
-
|
|
-
Adds "C:\Windows\explorer.exe, C:\Windows\svchost.exe" to Windows startup via registry.
|
|
1/5
|
Process
|
Creates process with hidden window
|
-
|
|
-
The process "C:\Windows\svchost.exe" starts with hidden window.
|
|
-
The process "cmd.exe" starts with hidden window.
|
|
1/5
|
Process
|
Creates system object
|
-
|
|
-
Creates mutex with name "䩈㹇䨼䙫套杉極桯瑧㤸㜵朳橵畨㝹常⠪⠦♞".
|
|
1/5
|
File System
|
Modifies application directory
|
-
|
|
-
Modifies "c:\program files\common files\designer\msaddndr.olb".
|
|
-
Modifies "c:\program files\common files\microsoft shared\dw\dbghelp.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\dw\dw20.exe".
|
|
-
Modifies "c:\program files\common files\microsoft shared\dw\dwtrig20.exe".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\1033\eeintl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\eqnedt32.cnt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\eqnedt32.exe".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\eqnedt32.exe.manifest".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\eqnedt32.hlp".
|
|
-
Modifies "c:\program files\common files\microsoft shared\equation\mtextra.ttf".
|
|
-
Modifies "c:\program files\common files\microsoft shared\euro\msoeuro.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\filters\msgfilt.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\filters\odffilt.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\filters\offfiltx.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\filters\visfilt.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\epsimp32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\gifimp32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\jpegim32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\ms.eps".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\ms.gif".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\ms.jpg".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\ms.png".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\ms.wpg".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\pictim32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\png32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\grphflt\wpgimp32.flt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\hx.hxc".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\hx.hxt".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\hxds.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\hxruntime.hxs".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\itircl55.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\keywords.hxk".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\msitss55.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\help\namedurls.hxk".
|
|
-
Modifies "c:\program files\common files\microsoft shared\msclientdatamgr\mscdm.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\aceintl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\aceodbci.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\acewstr.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\ado210.chm".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\alrtintl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\msointl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\msointl.dll.idx_dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\msointl.rest.idx_dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\mssoapr3.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\oarpmanr.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\osfintl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\osmdp32.msi".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\osmdp64.msi".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\osmia32.msi".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\osmia64.msi".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\readme.htm".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\1033\xlsrvintl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acecore.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acedao.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceerr.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acees.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceexch.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceexcl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceodbc.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceodexl.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceodtxt.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\aceoledb.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acetxt.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acewdat.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\acewss.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\adal.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\cmigrate.exe".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\csi.dll".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\csisyncclient.exe".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\as80.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\as90.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\db2v0801.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\informix.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\msjet.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\orcl7.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\sql2000.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\sql70.xsl".
|
|
-
Modifies "c:\program files\common files\microsoft shared\office15\datamodel\cartridges\sql90.xsl".
|
|
1/5
|
File System
|
Creates an unusually large number of files
|
-
|
|
-
Creates an unusually large number of files.
|
|
1/5
|
PE
|
Drops PE file
|
Dropper
|
|
-
Drops file "c:\program files\common files\designer\msaddndr.olb".
|
|
-
Drops file "c:\program files\common files\microsoft shared\dw\dbghelp.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\dw\dw20.exe".
|
|
-
Drops file "c:\program files\common files\microsoft shared\dw\dwtrig20.exe".
|
|
-
Drops file "c:\program files\common files\microsoft shared\equation\1033\eeintl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\equation\eqnedt32.exe".
|
|
-
Drops file "c:\program files\common files\microsoft shared\euro\msoeuro.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\filters\msgfilt.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\filters\odffilt.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\filters\offfiltx.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\filters\visfilt.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\epsimp32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\gifimp32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\jpegim32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\pictim32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\png32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\grphflt\wpgimp32.flt".
|
|
-
Drops file "c:\program files\common files\microsoft shared\help\hxds.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\help\hxruntime.hxs".
|
|
-
Drops file "c:\program files\common files\microsoft shared\help\itircl55.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\help\msitss55.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\msclientdatamgr\mscdm.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\aceintl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\aceodbci.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\acewstr.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\alrtintl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\msointl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\msointl.dll.idx_dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\msointl.rest.idx_dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\mssoapr3.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\oarpmanr.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\osfintl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\1033\xlsrvintl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acecore.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acedao.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceerr.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acees.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceexch.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceexcl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceodbc.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceodexl.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceodtxt.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\aceoledb.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acetxt.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acewdat.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\acewss.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\adal.dll".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\cmigrate.exe".
|
|
-
Drops file "c:\program files\common files\microsoft shared\office15\csi.dll".
|