|
|
4/5
|
File System
|
Known malicious file
|
Trojan
|
|
|
-
File "C:\Users\EEBsYm5\Desktop\858E70CA9281A346BF5399B181643ABA478960142637460FEA7B7D14D3192C01.exe" is a known malicious file.
|
|
|
3/5
|
Device
|
Monitors keyboard input
|
Keylogger
|
|
|
-
Installs system wide "WH_KEYBOARD_LL" hook(s) to monitor keystrokes.
|
|
|
3/5
|
Injection
|
Injects a file into another process
|
-
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\windows\explorer.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\windows\system32\taskhost.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\windows\system32\taskeng.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\windows\system32\dwm.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\dvd maker\publish eclipse.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft office\believes.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft office\draws-gpl-op.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\mozilla maintenance service\shemales.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\reference assemblies\clan-down.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft visual studio 8\naples-may.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\google\l_meetup.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft analysis services\thou_blah_thanks.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft synchronization services\msn arg.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\msbuild\schedulespackets.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\reference assemblies\individuals.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft synchronization services\protocols.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\microsoft sync framework\colleges wind bread.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\windows journal\correction ti.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\windows photo viewer\producing_install.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\windows media player\casa directors.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\reference assemblies\rhsublime.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\mozilla maintenance service\lions_commands.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\msbuild\resulted spanish.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\windows photo viewer\taste_regulated.exe"
|
|
|
-
"c:\users\eebsym5\desktop\858e70ca9281a346bf5399b181643aba478960142637460fea7b7d14d3192c01.exe" injects file into "c:\program files\windows mail\bo-optical-jar.exe"
|
|
|
2/5
|
Anti Analysis
|
Resolves APIs dynamically to possibly evade static detection
|
-
|
|
|
-
Resolves an unusually high number of APIs.
|
|
|
1/5
|
Process
|
Creates process with hidden window
|
-
|
|
|
-
The process ""C:\Users\EEBsYm5\Desktop\858E70CA9281A346BF5399B181643ABA478960142637460FEA7B7D14D3192C01.exe" --Service 2520" starts with hidden window.
|
