1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
Language
Server load
1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, VirSCAN can scan compressed files with password 'infected' or 'virus'.
| Safety rating:50 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | f8a3189df7df206607812e5a11c7b14b |
| file type: | EXE |
| Production company: | Lovely Studio [Www.Vicer.Cn] |
| version: | 0.1.0.0---0.1.0.0 |
| Shell or compiler information: | COMPILER:Microsoft Visual C++ v6.0 DLL * |
| Key behavior | |
|---|---|
| Behavior description: | 设置特殊文件夹属性 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 | |
| C:\Documents and Settings\Administrator\Local Settings\History | |
| C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 | |
| C:\Documents and Settings\Administrator\Cookies | |
| Behavior description: | 设置特殊文件属性 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat |
| Behavior description: | 获取窗口截图信息 |
| details: | Foreground window Info: HWND = 0x000103ce, DC = 0x0701067f. |
| Foreground window Info: HWND = 0x000103a6, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x00010414, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x000203fc, DC = 0x06010690. | |
| Foreground window Info: HWND = 0x00010344, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x00010344, DC = 0x0a010694. | |
| Behavior description: | 获取TickCount值 |
| details: | TickCount = 219385, SleepMilliseconds = 10. |
| TickCount = 219400, SleepMilliseconds = 10. | |
| TickCount = 219416, SleepMilliseconds = 10. | |
| TickCount = 219431, SleepMilliseconds = 10. | |
| TickCount = 219447, SleepMilliseconds = 10. | |
| TickCount = 219463, SleepMilliseconds = 10. | |
| TickCount = 219478, SleepMilliseconds = 10. | |
| TickCount = 219494, SleepMilliseconds = 10. | |
| TickCount = 219510, SleepMilliseconds = 10. | |
| TickCount = 219525, SleepMilliseconds = 10. | |
| TickCount = 219541, SleepMilliseconds = 10. | |
| TickCount = 219556, SleepMilliseconds = 10. | |
| TickCount = 219572, SleepMilliseconds = 10. | |
| TickCount = 219588, SleepMilliseconds = 10. | |
| TickCount = 219603, SleepMilliseconds = 10. | |
| Process behavior | |
|---|---|
| Behavior description: | 创建新文件进程 |
| details: | [0x00000a70]ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat" |
| Behavior description: | 枚举进程 |
| details: | N/A |
| Behavior description: | 创建本地线程 |
| details: | TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2648, ThreadID = 2680, StartAddress = 00407209, Parameter = 00000000 |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2648, ThreadID = 2684, StartAddress = 00407CCD, Parameter = 00000000 | |
| TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2648, ThreadID = 2688, StartAddress = 00409F72, Parameter = 00000000 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2752, StartAddress = 77DC845A, Parameter = 00000000 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2780, StartAddress = 00463D80, Parameter = 00DAD140 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2832, StartAddress = 7C947EBB, Parameter = 00000000 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2836, StartAddress = 7C930230, Parameter = 00000000 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2892, StartAddress = 77E56C7D, Parameter = 001FE418 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2896, StartAddress = 769AE43B, Parameter = 002004D0 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2900, StartAddress = 0161507F, Parameter = 0012959C | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2908, StartAddress = 0161507F, Parameter = 0012959C | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2912, StartAddress = 6359727B, Parameter = 0027F058 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2916, StartAddress = 6359727B, Parameter = 02E07240 | |
| TargetProcess: Temp.dat, InheritedFromPID = 2648, ProcessID = 2672, ThreadID = 2920, StartAddress = 6359727B, Parameter = 02E072E0 | |
| File behavior | |
|---|---|
| Behavior description: | 创建文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\api[1].php | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\浏览器.txt | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\background_gradient[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\httpErrorPagesScripts[1] | |
| Behavior description: | 创建可执行文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat |
| Behavior description: | 覆盖已有文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\浏览器.txt |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\background_gradient[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\httpErrorPagesScripts[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\background_gradient[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\info_48[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[2] | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Documents and Settings\Administrator\Local Settings\Temp |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp% | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\附加程序\吸色鬼.exe | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\附加程序\仿站器.exe | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\附加程序\CSS生成器.exe | |
| FileName = C:\Documents and Settings | |
| FileName = C:\Documents and Settings\Administrator | |
| FileName = C:\Documents and Settings\Administrator\Local Settings | |
| FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk | |
| FileName = C:\WINDOWS\system32\Ras\*.pbk | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\*.pbk | |
| FileName = C:\WINDOWS | |
| FileName = C:\WINDOWS\system32 | |
| FileName = C:\WINDOWS\system32\urlmon.dll | |
| Behavior description: | 设置特殊文件属性 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat |
| Behavior description: | 删除文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\api[1].php |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\ErrorPageTemplate[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[3] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\info_48[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\bullet[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[2] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\background_gradient[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\info_48[1] | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\bullet[1] | |
| Behavior description: | 设置特殊文件夹属性 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 | |
| C:\Documents and Settings\Administrator\Local Settings\History | |
| C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 | |
| C:\Documents and Settings\Administrator\Cookies | |
| Behavior description: | 修改文件内容 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat ---> Offset = 0 |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 22 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 39 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 55 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 72 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\配置文件\CMS标签配置文件.ini ---> Offset = 89 | |
| C:\Documents and Settings\Administrator\Local Settings\%temp%\浏览器.txt ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[2] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\navcancl[1] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[1] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\ErrorPageTemplate[2] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\errorPageStrings[1] ---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[2] ---> Offset = 0 | |
| Network behavior | |
|---|---|
| Behavior description: | 连接指定站点 |
| details: | InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000 |
| InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc000c, Flags = 0x00000000 | |
| Behavior description: | 打开HTTP连接 |
| details: | InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004 |
| Behavior description: | 建立到一个指定的套接字连接 |
| details: | URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000358 |
| URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000380 | |
| URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000480 | |
| URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000488 | |
| Behavior description: | 读取网络文件 |
| details: | hFile = 0x00cc000c, BytesToRead =4096, BytesRead = 4096. |
| hFile = 0x00cc0010, BytesToRead =2048, BytesRead = 2048. | |
| hFile = 0x00cc0014, BytesToRead =2048, BytesRead = 2048. | |
| Behavior description: | 发送HTTP包 |
| details: | GET /api.php?op=my_jsconm&id=4 HTTP/1.1 Accept: */* Accept-Language: zh-cn Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive |
| GET /api.php?op=my_jsconm&id=98&gg=14 HTTP/1.1 Accept: */* Accept-Language: zh-cn Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive | |
| Behavior description: | 打开HTTP请求 |
| details: | HttpOpenRequestA: ww****om:80/api.php?op=my_jsconm&id=4, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400000 |
| HttpOpenRequestA: ww****om:80/api.php?op=my_jsconm&id=98&gg=14, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400000 | |
| HttpOpenRequestA: ww****om:80/api.php?op=my_jsconm&id=4, hConnect = 0x00cc0008, hRequest = 0x00cc0010, Verb: GET, Referer: , Flags = 0x00400010 | |
| HttpOpenRequestA: ww****om:80/api.php?op=my_jsconm&id=98&gg=14, hConnect = 0x00cc000c, hRequest = 0x00cc0014, Verb: GET, Referer: , Flags = 0x00400010 | |
| Behavior description: | 按名称获取主机地址 |
| details: | GetAddrInfoW: ww****om |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings |
| Behavior description: | 删除注册表键值 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL | |
| Other behavior | |
|---|---|
| Behavior description: | 调整进程token权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| RasPbFile | |
| CritOpMutex | |
| Local\!PrivacIE!SharedMemory!Mutex | |
| MSCTF.Shared.MUTEX.IOH | |
| MSCTF.Shared.MUTEX.EHK | |
| Behavior description: | 创建事件对象 |
| details: | EventName = DINPUTWINMM |
| EventName = Global\userenv: User Profile setup event | |
| EventName = MSCTF.SendReceive.Event.EHK.IC | |
| EventName = MSCTF.SendReceive.Event.MFL.IC | |
| EventName = MSCTF.SendReceiveConection.Event.MFL.IC | |
| EventName = MSCTF.SendReceiveConection.Event.EHK.IC | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [WTWindow,E族站长工具箱正式版1.1] |
| NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] | |
| NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,] | |
| NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,] | |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 2672, Hwnd=0x103fe, Text = 连接认证...., ClassName = Afx:400000:b:10011:1900015:0. |
| Pid = 2672, Hwnd=0x10422, Text = <<, ClassName = Afx:400000:b:10011:1900015:0. | |
| Pid = 2672, Hwnd=0x103ce, Text = 内部免认证版 by www.wuzuowei.net, ClassName = Edit. | |
| Pid = 2672, Hwnd=0x10460, Text = 模板小偷, ClassName = Button(GroupBox). | |
| Pid = 2672, Hwnd=0x1046e, Text = 模板目录:, ClassName = Afx:400000:b:10011:1900015:0. | |
| Pid = 2672, Hwnd=0x1046a, Text = default, ClassName = Edit. | |
| Pid = 2672, Hwnd=0x10464, Text = 所有模型, ClassName = Button(CheckBox). | |
| Pid = 2672, Hwnd=0x10462, Text = 网址:, ClassName = Afx:400000:b:10011:1900015:0. | |
| Pid = 2672, Hwnd=0x1045e, Text = http://www.v93.com/, ClassName = Edit. | |
| Pid = 2672, Hwnd=0x1045c, Text = 摸一下, ClassName = Button. | |
| Pid = 2672, Hwnd=0x1043e, Text = 可用字段, ClassName = Button(GroupBox). | |
| Pid = 2672, Hwnd=0x1043c, Text = 全选/反选, ClassName = Button(CheckBox). | |
| Pid = 2672, Hwnd=0x10438, Text = 自动替换常用模板中的内容为标签, ClassName = Afx:400000:b:10011:1900015:0. | |
| Pid = 2672, Hwnd=0x10436, Text = <li class="listbox opc1"> <div class="layoutmsg"><a href="#" class="layoutcomm" target="_blank">评论</a><a class="#" href="javascript:void(0);" title="转发"><span></span>转发</a><a href="javascript:void(0);" title="喜欢" class="layoutlike">喜欢</a><a href="j, ClassName = Edit. | |
| Pid = 2672, Hwnd=0x1042c, Text = 生成, ClassName = Button. | |
| Behavior description: | 获取TickCount值 |
| details: | TickCount = 219385, SleepMilliseconds = 10. |
| TickCount = 219400, SleepMilliseconds = 10. | |
| TickCount = 219416, SleepMilliseconds = 10. | |
| TickCount = 219431, SleepMilliseconds = 10. | |
| TickCount = 219447, SleepMilliseconds = 10. | |
| TickCount = 219463, SleepMilliseconds = 10. | |
| TickCount = 219478, SleepMilliseconds = 10. | |
| TickCount = 219494, SleepMilliseconds = 10. | |
| TickCount = 219510, SleepMilliseconds = 10. | |
| TickCount = 219525, SleepMilliseconds = 10. | |
| TickCount = 219541, SleepMilliseconds = 10. | |
| TickCount = 219556, SleepMilliseconds = 10. | |
| TickCount = 219572, SleepMilliseconds = 10. | |
| TickCount = 219588, SleepMilliseconds = 10. | |
| TickCount = 219603, SleepMilliseconds = 10. | |
| Behavior description: | 获取光标位置 |
| details: | CursorPos = (80,18468), SleepMilliseconds = 10. |
| CursorPos = (6373,26501), SleepMilliseconds = 10. | |
| CursorPos = (19208,15725), SleepMilliseconds = 10. | |
| CursorPos = (11517,29359), SleepMilliseconds = 10. | |
| CursorPos = (27001,24465), SleepMilliseconds = 10. | |
| CursorPos = (5744,28146), SleepMilliseconds = 10. | |
| CursorPos = (23320,16828), SleepMilliseconds = 10. | |
| CursorPos = (10000,492), SleepMilliseconds = 10. | |
| CursorPos = (3034,11943), SleepMilliseconds = 10. | |
| CursorPos = (4866,5437), SleepMilliseconds = 10. | |
| CursorPos = (32430,14605), SleepMilliseconds = 10. | |
| CursorPos = (3941,154), SleepMilliseconds = 10. | |
| CursorPos = (331,12383), SleepMilliseconds = 10. | |
| CursorPos = (17460,18717), SleepMilliseconds = 10. | |
| CursorPos = (19757,19896), SleepMilliseconds = 10. | |
| Behavior description: | 打开事件 |
| details: | HookSwitchHookEnabledEvent |
| \SECURITY\LSA_AUTHENTICATION_INITIALIZED | |
| Global\SvcctrlStartEvent_A3752DX | |
| \INSTALLATION_SECURITY_HOLD | |
| MSFT.VSA.COM.DISABLE.2672 | |
| MSFT.VSA.IEC.STATUS.6c736db0 | |
| CTF.ThreadMIConnectionEvent.000007E8.00000000.0000000F | |
| CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.0000000F | |
| MSCTF.SendReceiveConection.Event.IOH.IC | |
| MSCTF.SendReceive.Event.IOH.IC | |
| _fCanRegisterWithShellService | |
| CTF.ThreadMIConnectionEvent.000007E8.00000000.00000010 | |
| CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.00000010 | |
| MSCTF.SendReceiveConection.Event.IOH.IKCB | |
| MSCTF.SendReceive.Event.IOH.IKCB | |
| Behavior description: | 获取窗口截图信息 |
| details: | Foreground window Info: HWND = 0x000103ce, DC = 0x0701067f. |
| Foreground window Info: HWND = 0x000103a6, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x00010414, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x000203fc, DC = 0x06010690. | |
| Foreground window Info: HWND = 0x00010344, DC = 0x0701067f. | |
| Foreground window Info: HWND = 0x00010344, DC = 0x0a010694. | |
| Behavior description: | 可执行文件签名信息 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat(签名验证: 未通过) |
| Behavior description: | 调用Sleep函数 |
| details: | [1]: MilliSeconds = 10. |
| [2]: MilliSeconds = 10. | |
| [3]: MilliSeconds = 100. | |
| [4]: MilliSeconds = 10. | |
| [5]: MilliSeconds = 10. | |
| [6]: MilliSeconds = 10. | |
| [7]: MilliSeconds = 10. | |
| [8]: MilliSeconds = 10. | |
| [9]: MilliSeconds = 10. | |
| [10]: MilliSeconds = 10. | |
| [3]: MilliSeconds = 10. | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [<,AfxWnd42s] |
| [Window,Class] = [>,AfxWnd42s] | |
| [Window,Class] = [,ComboLBox] | |
| [Window,Class] = [登陆设置,Button] | |
| [Window,Class] = [数据库,Button] | |
| [Window,Class] = [数据表,Button] | |
| [Window,Class] = [当前未打开表,Button] | |
| [Window,Class] = [拼音生成,Button] | |
| [Window,Class] = [,Button] | |
| [Window,Class] = [PC模板防盗,Button] | |
| [Window,Class] = [例:组分隔符留空 行分隔符为 ==> 分类1==>标签名1==>说明1 分类1==>标签名2==>说明2 例:组分隔符 <br> 行分隔符为 ==> 分类1==>标签名1==>说明1 <br> 分类1==>标签名2==>说明2 <br>,RichEdit20A] | |
| [Window,Class] = [导入格式例: 组分隔符为<br> (分隔符可变) 行分隔符为 ==> (分隔符可变) 分类1==>标签名1==>说明1 <br> 分类1==>标签名2==>说明2 <br> 组分隔符可留空,(不建议) 留空表示用回车符分隔,Afx:400000:b:10011:1900015:0] | |
| [Window,Class] = [设置,Button] | |
| [Window,Class] = [地址,Button] | |
| [Window,Class] = [,SysListView32] | |
| Behavior description: | 可执行文件MD5 |
| details: | C:\Documents and Settings\Administrator\Local Settings\%temp%\Temp.dat ---> 6d396248d316902d129f43c746cf6847 |
| Behavior description: | 打开互斥体 |
| details: | ShimCacheMutex |
| Local\!IETld!Mutex | |
| Local\WininetStartupMutex | |
| Local\_!MSFTHISTORY!_ | |
| Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5! | |
| Local\c:!documents and settings!administrator!cookies! | |
| Local\c:!documents and settings!administrator!local settings!history!history.ie5! | |
| Local\WininetConnectionMutex | |
| Local\WininetProxyRegistryMutex | |
| RasPbFile | |
| CtfmonInstMutexDefaultS-* | |
| Run screenshot |
|---|
 |
HOME
