|
|
5/5
|
File System
|
Encrypts content of user files
|
1
|
Ransomware
|
|
|
-
Encrypts the content of multiple user files. This is an indicator for ransomware.
|
|
|
2/5
|
Anti Analysis
|
Resolves APIs dynamically to possibly evade static detection
|
1
|
-
|
|
|
-
Resolves an unusually high number of APIs.
|
|
|
2/5
|
Information Stealing
|
Reads sensitive browser data
|
3
|
-
|
|
|
-
Trying to read sensitive data of web browser "Google Chrome" by file.
|
|
|
-
Trying to read sensitive data of web browser "Internet Explorer / Edge" by file.
|
|
|
-
Trying to read sensitive data of web browser "Mozilla Firefox" by file.
|
|
|
1/5
|
Masquerade
|
Changes folder appearance
|
123
|
-
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\03j4uqw0" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ketajp6d" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\vb18b0kb" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\xt1rpyg9" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\recent" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\contacts" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\desktop" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\documents" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\documents\my shapes" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\downloads" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\favorites" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\favorites\links" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\links" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\music" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\pictures" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\saved games" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\searches" has a changed appearance.
|
|
|
-
Folder "c:\users\5p5nrgjn0js halpmcxz\videos" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\ringtones" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\games" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
|
|
|
-
Folder "c:\users\all users\microsoft\windows\start menu\programs\startup" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\history" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\recent" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
|
|
|
-
Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
|
|
|
-
Folder "c:\users\default\contacts" has a changed appearance.
|
|
|
-
Folder "c:\users\default\desktop" has a changed appearance.
|
|
|
-
Folder "c:\users\default\documents" has a changed appearance.
|
|
|
-
Folder "c:\users\default\downloads" has a changed appearance.
|
|
|
-
Folder "c:\users\default\favorites" has a changed appearance.
|
|
|
-
Folder "c:\users\default\favorites\links" has a changed appearance.
|
|
|
-
Folder "c:\users\default\links" has a changed appearance.
|
|
|
-
Folder "c:\users\default\music" has a changed appearance.
|
|
|
-
Folder "c:\users\default\pictures" has a changed appearance.
|
|
|
-
Folder "c:\users\default\saved games" has a changed appearance.
|
|
|
-
Folder "c:\users\default\searches" has a changed appearance.
|
|
|
-
Folder "c:\users\default\videos" has a changed appearance.
|
|
|
-
Folder "c:\users" has a changed appearance.
|
|
|
-
Folder "c:\users\public\desktop" has a changed appearance.
|
|
|
-
Folder "c:\users\public" has a changed appearance.
|
|
|
-
Folder "c:\users\public\documents" has a changed appearance.
|
|
|
-
Folder "c:\users\public\downloads" has a changed appearance.
|
|
|
-
Folder "c:\users\public\libraries" has a changed appearance.
|
|
|
-
Folder "c:\users\public\music" has a changed appearance.
|
|
|
-
Folder "c:\users\public\music\sample music" has a changed appearance.
|
|
|
-
Folder "c:\users\public\pictures" has a changed appearance.
|
|
|
-
Folder "c:\users\public\pictures\sample pictures" has a changed appearance.
|
|
|
-
Folder "c:\users\public\recorded tv" has a changed appearance.
|
|
|
-
Folder "c:\users\public\recorded tv\sample media" has a changed appearance.
|
|
|
-
Folder "c:\users\public\videos" has a changed appearance.
|
|
|
-
Folder "c:\users\public\videos\sample videos" has a changed appearance.
|
|
|
1/5
|
Persistence
|
Installs system startup script or application
|
9
|
-
|
|
|
-
Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
|
|
|
-
Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.crypt" to Windows startup folder.
|
|
|
-
Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
|
|
|
-
Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini.crypt" to Windows startup folder.
|
|
|
-
Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
|
|
|
-
Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.crypt" to Windows startup folder.
|
|
|
-
Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\how to restore encrypted files.txt" to Windows startup folder.
|
|
|
-
Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\how to restore encrypted files.txt" to Windows startup folder.
|
|
|
-
Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\how to restore encrypted files.txt" to Windows startup folder.
|
|
|
1/5
|
Information Stealing
|
Possibly does reconnaissance
|
1
|
-
|
|
|
-
Possibly trying to gather information about application "Mozilla Firefox" by file.
|
|
|
1/5
|
File System
|
Creates an unusually large number of files
|
1
|
-
|
|
|
-
Creates an unusually large number of files.
|
|
|
1/5
|
Static
|
Unparsable sections in file
|
1
|
-
|
|
|
-
Static analyzer was unable to completely parse the analyzed file: C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\search1.exe.
|
