|
5/5
|
File System
|
Encrypts content of user files
|
Ransomware
|
|
-
Encrypts the content of multiple user files. This is an indicator for ransomware.
|
|
4/5
|
Injection
|
Writes into the memory of another running process
|
-
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" modifies memory of "c:\windows\system32\sihost.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" modifies memory of "c:\windows\system32\taskhostw.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" modifies memory of "c:\windows\system32\runtimebroker.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" modifies memory of "c:\windows\system32\backgroundtaskhost.exe"
|
|
4/5
|
Injection
|
Modifies control flow of another process
|
-
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\system32\sihost.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\system32\taskhostw.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\system32\runtimebroker.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe"
|
|
-
"c:\users\ciihmnxmn6ps\desktop\zotci.exe" creates thread in "c:\windows\system32\backgroundtaskhost.exe"
|
|
3/5
|
OS
|
Modifies certificate store
|
-
|
|
-
Adds a certificate to the local "ryukreadme.txt" by file.
|
|
-
Adds a certificate to the local "my" ryukreadme.txt list by file.
|
|
-
Adds a certificate to the local "my" revocation list by file.
|
|
-
Adds a certificate to the local "my" certificate trust list by file.
|
|
2/5
|
Anti Analysis
|
Delays execution
|
-
|
|
-
One thread sleeps more than 5 minutes.
|
|
2/5
|
Browser
|
Reads data related to browser cookies
|
-
|
|
-
Accesses Cookies for "Microsoft Internet Explorer".
|
|
1/5
|
Process
|
Creates process with hidden window
|
-
|
|
-
The process "net" starts with hidden window.
|
|
1/5
|
Process
|
Creates a page with write and execute permissions
|
-
|
|
-
Allocates a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
|
|
1/5
|
Anti Analysis
|
Resolves APIs dynamically
|
-
|
|
-
Resolves an unusually high number of APIs.
|
|
1/5
|
Masquerade
|
Changes folder appearance
|
Riskware
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\application data\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\desktop" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my music" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my pictures" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\documents\my videos" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessibility" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\accessories\tablet pc" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\administrative tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\maintenance" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\startup" has a changed appearance.
|
|
-
Folder "c:\documents and settings\all users\start menu\programs\system tools" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
-
Folder "c:\documents and settings\ciihmnxmn6ps\appdata\local\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
|
|
1/5
|
Persistence
|
Installs system startup script or application
|
-
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\application data\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
-
Adds "c:\documents and settings\all users\microsoft\windows\start menu\programs\startup\ryukreadme.txt" to Windows startup folder.
|
|
1/5
|
File System
|
Creates an unusually large number of files
|
-
|
|
-
Creates an unusually large number of files.
|
|
1/5
|
Process
|
Process crashed
|
-
|
|
-
Process "c:\windows\system32\sihost.exe" crashed.
|
|
-
Process "c:\windows\system32\taskhostw.exe" crashed.
|
|
-
Process "c:\windows\system32\backgroundtaskhost.exe" crashed.
|
|
-
Process "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe" crashed.
|