VirSCAN.org - Free Multi-Engine Online Virus Scanner v1.02, Supports 47 AntiVirus Engines!

Main Menu

File information

Safety rating:79

Behavior list

Basic Information
MD5:	bc1cad07793f8fef548fe77e9d87bd15
file type:	EXE
Production company:
version:	2.3.3.8---2, 3, 3, 8
Shell or compiler information:

Key behavior
Behavior description:	写权限映射文件
details:	CiceroSharedMemDefaultS-*
	MSCTF.MarshalInterface.FileMap.MBB..ODNGH
	MSCTF.MarshalInterface.FileMap.MBB.B.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.C.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.D.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.E.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.F.NHNGH
	MSCTF.MarshalInterface.FileMap.MBB.G.NHNGH
	MSCTF.Shared.SFM.MBB
Behavior description:	屏蔽窗口关闭消息
details:	hWnd = 0x000202b4, Text = , ClassName = #32770.

Process behavior
Behavior description:	枚举进程
details:	N/A

File behavior
Behavior description:	写权限映射文件
details:	CiceroSharedMemDefaultS-*
	MSCTF.MarshalInterface.FileMap.MBB..ODNGH
	MSCTF.MarshalInterface.FileMap.MBB.B.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.C.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.D.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.E.NGNGH
	MSCTF.MarshalInterface.FileMap.MBB.F.NHNGH
	MSCTF.MarshalInterface.FileMap.MBB.G.NHNGH
	MSCTF.Shared.SFM.MBB
Behavior description:	修改文件内容
details:	C:\Documents and Settings\All Users\Application Data\BlueInstall\BlueSoftSetup.log---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\BlueInstall\BlueSoftSetup.log---> Offset = -1
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\install_button.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\complete_button.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\box_button.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\cancel_button.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\checkbox.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\xuanze_button.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\frame.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\logo.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\bao_logo.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\scroll_bkgnd.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\scroll_thumb.png---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\wait.gif---> Offset = 0
	C:\Documents and Settings\All Users\Application Data\LGPacket\skin\deficon.png---> Offset = 0
Behavior description:	查找文件
details:	FileName = C:\Documents and Settings
	FileName = C:\Documents and Settings\All Users
	FileName = C:\Documents and Settings\All Users\Application Data

Other behavior
Behavior description:	屏蔽窗口关闭消息
details:	hWnd = 0x000202b4, Text = , ClassName = #32770.
Behavior description:	创建互斥体
details:	BlueSoftSetupInstance
	CTF.LBES.MutexDefaultS-*
	CTF.Compart.MutexDefaultS-*
	CTF.Asm.MutexDefaultS-*
	CTF.Layouts.MutexDefaultS-*
	CTF.TMD.MutexDefaultS-*
	CTF.TimListCache.FMPDefaultS-MUTEX.DefaultS-
	MSCTF.Shared.MUTEX.ELH
	MSCTF.Shared.MUTEX.MBB
Behavior description:	内联HOOK
details:	C:\WINDOWS\system32\kernel32.dll--->SetUnhandledExceptionFilter Offset = 0x0
Behavior description:	查找指定窗口
details:	NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
	NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
Behavior description:	获取系统权限
details:	SE_LOAD_DRIVER_PRIVILEGE

Run screenshot