1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Language
Server load
1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
| Safety rating:35 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | d9df39024db8489b603f5e5c40491882 |
| file type: | EXE |
| Production company: | |
| version: | |
| Shell or compiler information: | COMPILER:Microsoft Visual C++ 6.0 |
| Key behavior | |
|---|---|
| Behavior description: | 修改原系统的EXE文件 |
| details: | C:\install.exe |
| C:\222c25ed\IE8-Setup-Full\IE-REDIST.EXE | |
| C:\222c25ed\IE8-Setup-Full\installservices.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Temp\sogouexplorerup.exe | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll | |
| Behavior description: | 设置特殊文件属性 |
| details: | C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe | |
| Behavior description: | 设置特殊文件夹属性 |
| details: | C:\DiskX\RECYCLER |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 | |
| C:\Documents and Settings\Administrator\Local Settings\History | |
| C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 | |
| C:\Documents and Settings\Administrator\Cookies | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache | |
| C:\Documents and Settings\Administrator\IECompatCache | |
| Behavior description: | 设置消息钩子 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\yha3.tmp |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit |
| Process behavior | |
|---|---|
| Behavior description: | 创建进程 |
| details: | [0x00000b10]ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" |
| [0x00000c24]ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:79873 | |
| Behavior description: | 创建本地线程 |
| details: | TargetProcess: explorer.exe, InheritedFromPID = 1932, ProcessID = 2000, ThreadID = 2824, StartAddress = 03B96E48, Parameter = 03D5224C |
| TargetProcess: explorer.exe, InheritedFromPID = 1932, ProcessID = 2000, ThreadID = 2828, StartAddress = 719CD33A, Parameter = 0015C928 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2840, StartAddress = 20057ACA, Parameter = 00050034 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2844, StartAddress = 20057626, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2848, StartAddress = 2005781F, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2852, StartAddress = 2005790C, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2856, StartAddress = 20056EA8, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2808, ProcessID = 2832, ThreadID = 2860, StartAddress = 20056EC2, Parameter = 00000000 | |
| TargetProcess: explorer.exe, InheritedFromPID = 1932, ProcessID = 2000, ThreadID = 2876, StartAddress = 7C930230, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3048, StartAddress = 77DC845A, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3056, StartAddress = 7C947EBB, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3060, StartAddress = 7C930230, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3064, StartAddress = 7C949B6F, Parameter = 00000000 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3068, StartAddress = 77E56C7D, Parameter = 001967C8 | |
| TargetProcess: iexplore.exe, InheritedFromPID = 2348, ProcessID = 3040, ThreadID = 3072, StartAddress = 5DE05ABD, Parameter = 00198578 | |
| Behavior description: | 创建新文件进程 |
| details: | [0x00000abc]ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe" |
| [0x00000af8]ImagePath = C:\Program Files\Microsoft\DesktopLayer.exe, CmdLine = "C:\Program Files\Microsoft\DesktopLayer.exe" | |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 创建文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp | |
| C:\Program Files\Microsoft\px4.tmp | |
| C:\Program Files\Microsoft\DesktopLayer.exe | |
| C:\Program Files\Internet Explorer\dmlconf.dat | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{5ED473DC-9C9B-11E7-91C0-7B****28}.dat | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF48B2.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{5ED473DD-9C9B-11E7-91C0-7B****28}.dat | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF53D8.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\yixun_com[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\favicon[1].ico | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | |
| Behavior description: | 修改原系统的EXE文件 |
| details: | C:\install.exe |
| C:\222c25ed\IE8-Setup-Full\IE-REDIST.EXE | |
| C:\222c25ed\IE8-Setup-Full\installservices.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Temp\sogouexplorerup.exe | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll | |
| Behavior description: | 创建可执行文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe |
| C:\Program Files\Microsoft\DesktopLayer.exe | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | |
| Behavior description: | 删除文件 |
| details: | C:\Program Files\Microsoft\px4.tmp |
| C:\Documents and Settings\Administrator\Local Settings\Temp\Kno1.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\Kno4E.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\KnoC.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\KnoD.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF4F53.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF5D7F.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF9415.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF949B.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF94ED.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF94F2.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF951A.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF951F.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF99D8.tmp | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\~DF48B2.tmp | |
| Behavior description: | 覆盖已有文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp |
| C:\Program Files\Microsoft\px4.tmp | |
| C:\Program Files\Internet Explorer\dmlconf.dat | |
| Behavior description: | 复制文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> C:\Program Files\Microsoft\DesktopLayer.exe |
| Behavior description: | 内存映射方式修改可执行文件 |
| details: | C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll |
| Behavior description: | 设置特殊文件属性 |
| details: | C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Documents and Settings\Administrator\Local Settings\Temp |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp% | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe | |
| FileName = C:\Program Files\Internet Explorer\IEXPLORE.EXE | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\*.TMP | |
| FileName = C:\WINDOWS\system32\dllcache\*.exe | |
| FileName = C:\WINDOWS\system32\dllcache\*.scr | |
| FileName = C:\Documents and Settings\Administrator\桌面\*.* | |
| FileName = C:\Documents and Settings\All Users\桌面\*.* | |
| FileName = C:\*.exe | |
| FileName = C:\Program Files\Internet Explorer\iexplore.exe | |
| FileName = C:\*.* | |
| FileName = C:\222c25ed\*.* | |
| FileName = C:\222c25ed\IE8-Setup-Full\*.* | |
| FileName = C:\*.scr | |
| Behavior description: | 设置特殊文件夹属性 |
| details: | C:\DiskX\RECYCLER |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 | |
| C:\Documents and Settings\Administrator\Local Settings\History | |
| C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 | |
| C:\Documents and Settings\Administrator\Cookies | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache | |
| C:\Documents and Settings\Administrator\IECompatCache | |
| Behavior description: | 修改文件内容 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> Offset = 0 |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp ---> Offset = 10240 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp ---> Offset = 20480 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp ---> Offset = 30720 | |
| C:\Documents and Settings\Administrator\Local Settings\Temp\yha3.tmp ---> Offset = 40960 | |
| C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 65536 | |
| C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 131072 | |
| C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 196608 | |
| C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 0 | |
| C:\Program Files\Internet Explorer\dmlconf.dat ---> Offset = 0 | |
| C:\install.exe ---> Offset = 496092 | |
| C:\install.exe ---> Offset = 496440 | |
| C:\install.exe ---> Offset = 1152 | |
| C:\install.exe ---> Offset = 248 | |
| Network behavior | |
|---|---|
| Behavior description: | 下载文件 |
| details: | URLDownloadToFileW: http://ww****om/favicon.ico ---> C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | |
| Behavior description: | 连接指定站点 |
| details: | InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000 |
| InternetConnectA: ServerName = ur****om, PORT = 443, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000200 | |
| Behavior description: | 打开HTTP连接 |
| details: | InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004 |
| InternetOpenA: UserAgent: VCSoapClient, hSession = 0x00cc0010 | |
| Behavior description: | 建立到一个指定的套接字连接 |
| details: | URL: go****om, IP: **.133.40.**:80, SOCKET = 0x000000ac |
| URL: fg****om, IP: **.133.40.**:443, SOCKET = 0x000000b8 | |
| URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x0000044c | |
| URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000578 | |
| URL: ur****om, IP: **.133.40.**:443, SOCKET = 0x00000588 | |
| Behavior description: | 读取网络文件 |
| details: | hFile = 0x00cc000c, BytesToRead =2048, BytesRead = 2048. |
| hFile = 0x00cc0018, BytesToRead =4095, BytesRead = 4095. | |
| Behavior description: | 发送HTTP包 |
| details: | GET / HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Accept-Encoding: gzip, deflate Host: ww****om Connection: Keep-Alive |
| GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive | |
| Behavior description: | 打开HTTP请求 |
| details: | HttpOpenRequestA: ww****om:80/, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400200 |
| HttpOpenRequestA: ww****om:80/favicon.ico, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00600010 | |
| HttpOpenRequestA: ur****om:443/urs.asmx?msurs-client-key=p9zen1vk8n9k00bdmwzxiq%3d%3d&msurs-patented-lock=ochrf2f110w%3d, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: POST, Referer: , Flags = 0x04880300 | |
| Behavior description: | 按名称获取主机地址 |
| details: | gethostbyname: go****om |
| gethostbyname: fg****om | |
| GetAddrInfoW: ww****om | |
| GetAddrInfoW: ur****om | |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe | |
| \REGISTRY\USER\S-*\SessionInformation\ProgramCount | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings | |
| \REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Recovery\Active\{5ED473DC-9C9B-11E7-91C0-7B****28} | |
| \REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\Enable | |
| \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Main\Window_Placement | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTime | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeCount | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Count | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Time | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\ | |
| Behavior description: | 删除注册表键值 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL | |
| Behavior description: | 删除注册表键 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\ |
| \REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\InprocServer32\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\InprocServer32\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}\InprocServer32\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32\ | |
| \REGISTRY\USER\S-*_CLASSES\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ | |
| \REGISTRY\USER\S-*_CLASSES\JavaPlugin.1000\CLSID\ | |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit |
| Other behavior | |
|---|---|
| Behavior description: | 创建互斥体 |
| details: | KyUffThOkYwRRtgPP |
| CTF.LBES.MutexDefaultS-* | |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.IOH | |
| Residented | |
| MSCTF.Shared.MUTEX.IHJ | |
| Local\!BrowserEmulation!SharedMemory!Mutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| RasPbFile | |
| Behavior description: | 枚举网络共享资源 |
| details: | N/A |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,BrowserFrameGripperClass] |
| [Window,Class] = [缩放级别,ToolbarWindow32] | |
| [Window,Class] = [,msctls_progress32] | |
| [Window,Class] = [,SysLink] | |
| [Window,Class] = [,Static] | |
| [Window,Class] = [http://www.yixun.com/ - Windows Internet Explorer,IEFrame] | |
| [Window,Class] = [,UniversalSearchBand] | |
| [Window,Class] = [,TravelBand] | |
| [Window,Class] = [文件大小未知,Static] | |
| [Window,Class] = [,CommandBarClass] | |
| [Window,Class] = [,ReBarWindow32] | |
| [Window,Class] = [,TabBandClass] | |
| [Window,Class] = [打开此类文件前总是询问(&W),Button] | |
| [Window,Class] = [发行者:,Static] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 2700, Hwnd=0x10344, Text = 确定, ClassName = Button. |
| Pid = 2700, Hwnd=0x10348, Text = Not Find File!, ClassName = Static. | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| NtUserFindWindowEx: [Class,Window] = [,GINA Logon] | |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| NtUserFindWindowEx: [Class,Window] = [Static,] | |
| NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,] | |
| NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,] | |
| Behavior description: | 打开事件 |
| details: | HookSwitchHookEnabledEvent |
| CTF.ThreadMIConnectionEvent.000007E8.00000000.00000010 | |
| CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.00000010 | |
| MSCTF.SendReceiveConection.Event.IOH.IC | |
| MSCTF.SendReceive.Event.IOH.IC | |
| MSCTF.SendReceiveConection.Event.IHJ.IC | |
| MSCTF.SendReceive.Event.IHJ.IC | |
| Global\SvcctrlStartEvent_A3752DX | |
| \SECURITY\LSA_AUTHENTICATION_INITIALIZED | |
| Isolation Signal Registry Event (5ED473D9-9C9B-11E7-91C0-7B****28, 0) | |
| \INSTALLATION_SECURITY_HOLD | |
| MSFT.VSA.COM.DISABLE.3040 | |
| MSFT.VSA.IEC.STATUS.6c736db0 | |
| Isolation Signal Registry Event (5ED473DA-9C9B-11E7-91C0-7B****28, 0) | |
| IE_EarlyTabStart_0xbe4 | |
| Behavior description: | 调整进程token权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Behavior description: | 枚举窗口 |
| details: | N/A |
| Behavior description: | 修改后的可执行文件签名信息 |
| details: | C:\install.exe(签名验证: 未通过) |
| C:\222c25ed\IE8-Setup-Full\IE-REDIST.EXE(签名验证: 未通过) | |
| C:\222c25ed\IE8-Setup-Full\installservices.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Temp\sogouexplorerup.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll(签名验证: 未通过) | |
| Behavior description: | 可执行文件签名信息 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe(签名验证: 未通过) |
| C:\Program Files\Microsoft\DesktopLayer.exe(签名验证: 未通过) | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico(签名验证: 未通过) | |
| Behavior description: | 创建事件对象 |
| details: | EventName = MSCTF.SendReceive.Event.IOH.IC |
| EventName = MSCTF.SendReceiveConection.Event.IOH.IC | |
| EventName = Isolation Signal Registry Event (5ED473D9-9C9B-11E7-91C0-7B****28, 0) | |
| EventName = IE_EarlyTabStart_0xbe4 | |
| EventName = Isolation Signal Registry Event (5ED473DA-9C9B-11E7-91C0-7B****28, 0) | |
| EventName = DINPUTWINMM | |
| EventName = Global\userenv: User Profile setup event | |
| EventName = MSCTF.SendReceive.Event.ANB.IC | |
| EventName = MSCTF.SendReceiveConection.Event.ANB.IC | |
| EventName = MSCTF.SendReceive.Event.EOD.IC | |
| EventName = MSCTF.SendReceive.Event.ENH.IC | |
| EventName = MSCTF.SendReceiveConection.Event.EOD.IC | |
| EventName = MSCTF.SendReceiveConection.Event.ENH.IC | |
| EventName = Local\RSS Eventing Event Event 00000be0 | |
| EventName = IEFrame.EventCheckDefaultBrowser | |
| Behavior description: | 可执行文件MD5 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> aca5487a29ce8985398fc80fde1b5655 |
| C:\Program Files\Microsoft\DesktopLayer.exe ---> aca5487a29ce8985398fc80fde1b5655 | |
| C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico ---> fe1d0ee5901dd167ee9b28eece31786c | |
| Behavior description: | 打开互斥体 |
| details: | ShimCacheMutex |
| Residented | |
| Local\_!MSFTHISTORY!_ | |
| Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5! | |
| Local\c:!documents and settings!administrator!cookies! | |
| Local\c:!documents and settings!administrator!local settings!history!history.ie5! | |
| Local\WininetStartupMutex | |
| Local\WininetConnectionMutex | |
| Local\WininetProxyRegistryMutex | |
| Local\!BrowserEmulation!SharedMemory!Mutex | |
| Local\!IETld!Mutex | |
| RasPbFile | |
| CtfmonInstMutexDefaultS-* | |
| Local\RSS Eventing Connection Database Mutex 00000be0 | |
| Local\c:!documents and settings!administrator!local settings!application data!microsoft!feeds cache! | |
| Behavior description: | 修改后的可执行文件MD5 |
| details: | C:\install.exe ---> 2f23f4f5b3906b3616505831e167d765 |
| C:\222c25ed\IE8-Setup-Full\IE-REDIST.EXE ---> 文件过大! | |
| C:\222c25ed\IE8-Setup-Full\installservices.exe ---> 209c54837eee7b075425acb967f91793 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\ARPPRODUCTICON.exe ---> b9151a4d293580c1b27ad57197233f24 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut1_EDD4ABB1C1B34A9D84CE33FBFB5D3639.exe ---> 8b7c9898db3264f0bffed060e5f94168 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut2_E88611396FF84AFCB2EE5C1594058E02.exe ---> 76c2cbdb1db796f429650c6a2a69bf73 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut311_0951773981FA4AB2BC21B7DCEC95892A.exe ---> 654b2fc3bc968555ef1397b592741864 | |
| C:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{052CFB79-9D62-42E3-8A15-DE66C2C97C3E}\NewShortcut31_2F252077BA3F4362913955273A708467.exe ---> e8ff7162c47dddb830248bbabe5da9f7 | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Temp\sogouexplorerup.exe ---> abc3a846eb9be42b20e796c57090c4bf | |
| C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll ---> ac4e91a2d46da33d7e9ba7294eefd448 | |
| Behavior description: | 加载新释放的文件 |
| details: | Image: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\yha3.tmp. |
| Run screenshot |
|---|
 |
HOME
