Search
Keyword: os2first
\CurrentControlSet\ services\{string1}{string2} Information Theft This Trojan Spy gathers the following data: Machine Name System Locale OS Version Running Processes Other Details This Trojan Spy connects to the
\ControlSet001\ services\{string1}{string2} Start = "2" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ services\{string1}{string2} ErrorControl = "0" HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\ services\{string1}{string2}
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It saves downloaded files into the said created
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It saves downloaded files into the said created
Characters} 221.165.123.72:80/{Random Characters} 223.197.185.60:80/{Random Characters} --> Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running
Characters} 217.199.160.224:8080/{Random Characters} --> Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running Processes File CRC Processor
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Arrival Details This
the said registry entry is 2 .) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\wuauserv Start = 4 (Note: The default value data of the said registry entry is 2 .) Propagation This worm drops
Server ID = "2" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager\Accounts\WhoWhere LDAP Server ID = "3" HKEY_CURRENT_USER\Software\Microsoft\ Internet Account Manager Server ID = "4
\ \thunderbird\ It avoids infecting system with the following OS Language Code: 1049 - Russian 1058 - Ukrainian 1059 - Belarusian 1064 - Tajik (Cyrillic) 1067 - Armenian 1068 - Azeri (Latin) 1079 - Georgian 1087 -
}k.top/ {BLOCKED}.{BLOCKED}.57.0/27:6893 {BLOCKED}.{BLOCKED}.17.0/27:6893 {BLOCKED}.{BLOCKED}.176.0/22:6893 It does the following: It avoids infecting system with the following OS Language Code: 1049 -
This Adware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It arrives as a component bundled with malware/grayware
It does the following: It avoids infecting system with the following OS Language Code: 1049 - Russian 1058 - Ukrainian 1059 - Belarusian 1064 - Tajik (Cyrillic) 1067 - Armenian 1068 - Azeri (Latin)
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It gathers certain information on the affected
{Random Characters} 220.247.70.174:80/{Random Characters} --> Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running Processes File CRC Processor
This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It gathers certain information on the affected
{String1}{String2}\{String1}{String2}.exe Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running Processes File CRC Processor Architecture Other
Computer Name Process SessionId OS Version Running Processes File CRC Processor Architecture Other Details This Trojan Spy does the following: It creates the service for persistence if the sample is executed
have rootkit capabilities. Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running Processes File CRC Processor Architecture Stolen Information
Characters} Information Theft This Trojan Spy gathers the following data: Computer Name Process SessionId OS Version Running Processes File CRC Processor Architecture Other Details This Trojan Spy does the