1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:72 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 98d95fe6d0b70e846c145cb0bdd478a7 |
| file type: | EXE |
| Production company: | CF冰心 |
| version: | 1.0.4.11---1.0.4.11 |
| Shell or compiler information: | |
| Subfile information: | upx30_1d6ef770dumpFile / 9d3957d72e96774d7b9924392d8cc931 / EXE |
| Key behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| \Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT | |
| MSCTF.MarshalInterface.FileMap.EBE..INPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.B.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.C.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.D.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.E.EAAHH | |
| MSCTF.MarshalInterface.FileMap.EBE.F.DBAHH | |
| MSCTF.MarshalInterface.FileMap.EBE.G.CCAHH | |
| MSCTF.Shared.SFM.EBE | |
| MSCTF.MarshalInterface.FileMap.EBE.H.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.I.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.J.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.K.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.L.GICLH | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,_EL_ClientSock] |
| [Window,Class] = [,_EL_Timer] | |
| Process behavior | |
|---|---|
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| \Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT | |
| MSCTF.MarshalInterface.FileMap.EBE..INPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.B.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.C.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.D.GPPGH | |
| MSCTF.MarshalInterface.FileMap.EBE.E.EAAHH | |
| MSCTF.MarshalInterface.FileMap.EBE.F.DBAHH | |
| MSCTF.MarshalInterface.FileMap.EBE.G.CCAHH | |
| MSCTF.Shared.SFM.EBE | |
| MSCTF.MarshalInterface.FileMap.EBE.H.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.I.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.J.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.K.GICLH | |
| MSCTF.MarshalInterface.FileMap.EBE.L.GICLH | |
| Behavior description: | 修改文件内容 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT---> Offset = 0 |
| Network behavior | |
|---|---|
| Behavior description: | 建立到一个指定的套接字连接 |
| details: | 117.21.225.209:2360 |
| Other behavior | |
|---|---|
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 1048, Hwnd=0x202b4, Text = CF冰心官服收费辅助, ClassName = DELE_exui_Client. |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,_EL_ClientSock] |
| [Window,Class] = [,_EL_Timer] | |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.ELH | |
| MSCTF.Shared.MUTEX.EBE | |
| Behavior description: | 获取TickCount值 |
| details: | TickCount = 487384, SleepMilliseconds = 9. |
| TickCount = 487414, SleepMilliseconds = 8. | |
| TickCount = 487428, SleepMilliseconds = 7. | |
| TickCount = 487443, SleepMilliseconds = 6. | |
| TickCount = 487458, SleepMilliseconds = 5. | |
| TickCount = 496969, SleepMilliseconds = 1. | |
| TickCount = 496985, SleepMilliseconds = 1. | |
| TickCount = 498110, SleepMilliseconds = 1. | |
| TickCount = 498126, SleepMilliseconds = 1. | |
| TickCount = 504454, SleepMilliseconds = 1. | |
| TickCount = 504469, SleepMilliseconds = 1. | |
| TickCount = 504547, SleepMilliseconds = 1. | |
| TickCount = 504563, SleepMilliseconds = 1. | |
| Run screenshot |
|---|
 |
HOME
