Search
Keyword: microsoft internet explorer
\WriteLines.exe It creates the following folders: %System Root%\ImgContent %User Profile%\Application Data\Microsoft\Forms (Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows
\Microsoft\ Windows\CurrentVersion\Run {5BEFF50D-D6EE-01EC-61D4-279E7A06BA6C} = %Application Data%\{random1}\{random}.exe Other System Modifications This Trojan adds the following registry keys as part of its
attackers to execute arbitrary commands via a crafted cell. It takes advantage of the following vulnerabilities: CVE-2016-7262 | Microsoft Office Security Feature Bypass Vulnerability Downloaded from the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run Stubbish = "%System%\stubbish.exe" It modifies the following registry entries to ensure it automatic execution at every system startup:
Autostart Technique This Trojan adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {random CLSID} =
automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Windows AppInit_DLLs = "{All Users' Profile}\Application Data\Mozilla\{random file name}.dll"
every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Microsoft Updater = "{malware path and filename}" Process Termination This Trojan terminates the following processes
every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Microsoft Updater = "{malware path and filename}" Process Termination This Trojan terminates the following processes
Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.) It bears the file icons of the following applications: Microsoft Word Autostart Technique This spyware adds the following
This malware is involved in the targeted attacks that took advantage of an unpatched Microsoft Office vulnerability, namely CVE-2013-3906, on November 2013. Victims of this malware may find the
entries to enable automatic execution of dropped component at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run Qvodupd = ""%User Profile%\Music\Qvodupd.exe"" (Windows 7
following files: %User Temp%\tmp.ps1 %Application Data%\Microsoft\Windows\Recent\CustomDestinations\{Random Text}.temp %Application Data%\Microsoft\Windows\Recent\CustomDestinations\{Random Text
following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run {ID Number} = %User Temp%\{10 random letters}.exe
\Software\Microsoft\Windows\CurrentVersion\Run /v Service /t REG_SZ /d %PrograData\README.html (Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make
adds the following registry entries to enable its automatic execution at every system startup: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run {Blank} = %System%\BEKA.exe Other System
adds the following registry entries to enable its automatic execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run ctfmoon.exe = "%System%\Com\ctfmoon.exe
execution at every system startup: HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Run CryptoLocker = "%Application Data%\{random file name}.exe " HKEY_CURRENT_USER\Software\Microsoft\ Windows
Modifications This Trojan adds the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Tracing\package_RASAPI32 HKEY_LOCAL_MACHINE\Software\Microsoft\ Tracing\package_RASMANCS It adds the following
8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.) Other System Modifications This Trojan adds the following registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\ Tracing
\Microsoft\ Windows\CurrentVersion\Run {ID Number} = %User Temp%\{10 random letters}.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run {7 random numbers} = {7 random numbers} Dropping