VirSCAN VirSCAN

1, Możesz wysyłać dowolne pliki, ale nie większe niż 20Mb.
2, VirSCAN obsługuje dekompresję Rar/Zip, ale archiwum musi zawierać mniej niż 20 plików.
3, VirSCAN może skanować pliki skompresowane i zaszyfrowane hasłem "infected" lub "virus".

Język
Obciążenie serwera
Server Load

Informacje o pliku
Ocena bezpieczeństwa:35
Lista zachowań
Raport analizy zachowania:         Raport analizy zachowania pliku Threatbook
Podstawowe informacje
MD5:2063ae5f3d6093cfb614bb192cefa0d3
Typ pliku:EXE
Firma produkcyjna:
Wersja:0.6.1.0---0, 6, 1, 0
Informacje o powłoce lub kompilatorze:PACKER:UPolyX v0.5
Kluczowe zachowanie
Opis zachowania:修改原系统的EXE文件
Szczegóły:C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll
Opis zachowania:设置特殊文件夹属性
Szczegóły:C:\DiskX\RECYCLER
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\Administrator\IECompatCache
Opis zachowania:查找文件方式探测虚拟机
Szczegóły:FindFirstFileEx: FileName = C:\Documents and Settings\Administrator\Local Settings\Application Data\VMware\*.*
FindFirstFileEx: FileName = C:\Documents and Settings\Administrator\Local Settings\Temp\VMwareDnD\*.*
Opis zachowania:获取TickCount值
Szczegóły:TickCount = 276250, SleepMilliseconds = 60000.
TickCount = 276265, SleepMilliseconds = 60000.
TickCount = 276281, SleepMilliseconds = 60000.
TickCount = 276296, SleepMilliseconds = 60000.
TickCount = 276312, SleepMilliseconds = 60000.
TickCount = 276328, SleepMilliseconds = 60000.
Opis zachowania:修改注册表_启动项
Szczegóły:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Zachowanie procesowe
Opis zachowania:创建进程
Szczegóły:[0x00000a3c]ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
[0x00000afc]ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:79873
Opis zachowania:创建新文件进程
Szczegóły:[0x00000a10]ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe"
[0x00000a24]ImagePath = C:\Program Files\Microsoft\DesktopLayer.exe, CmdLine = "C:\Program Files\Microsoft\DesktopLayer.exe"
Opis zachowania:枚举进程
Szczegóły:N/A
Opis zachowania:创建本地线程
Szczegóły:TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2528, ThreadID = 2584, StartAddress = 77E56C7D, Parameter = 001A3698
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2528, ThreadID = 2588, StartAddress = 769AE43B, Parameter = 001A5E30
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2528, ThreadID = 2592, StartAddress = 00402BBE, Parameter = 00AD3A80
TargetProcess: %temp%\****.exe, InheritedFromPID = 2000, ProcessID = 2528, ThreadID = 2604, StartAddress = 00402BBE, Parameter = 00AD3A80
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2628, StartAddress = 20057ACA, Parameter = 00050034
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2632, StartAddress = 20057626, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2636, StartAddress = 2005781F, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2640, StartAddress = 2005790C, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2644, StartAddress = 20056EA8, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2596, ProcessID = 2620, ThreadID = 2648, StartAddress = 20056EC2, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2168, ProcessID = 2768, ThreadID = 2776, StartAddress = 77DC845A, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2168, ProcessID = 2768, ThreadID = 2780, StartAddress = 7C947EBB, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2168, ProcessID = 2768, ThreadID = 2784, StartAddress = 7C930230, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2168, ProcessID = 2768, ThreadID = 2788, StartAddress = 7C949B6F, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2168, ProcessID = 2768, ThreadID = 2792, StartAddress = 77E56C7D, Parameter = 001967C8
Zachowanie pliku
Opis zachowania:创建文件
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe
C:\Program Files\Microsoft\px3.tmp
C:\Program Files\Microsoft\DesktopLayer.exe
C:\Program Files\Internet Explorer\dmlconf.dat
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BC2F4288-4F9A-11E9-91C0-7B****28}.dat
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFB26.tmp
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{BC2F4289-4F9A-11E9-91C0-7B****28}.dat
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1766.tmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\yixun_com[1]
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\favicon[1].ico
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
C:\Documents and Settings\Administrator\Application Data\RapidCRC\options.bin
Opis zachowania:修改原系统的EXE文件
Szczegóły:C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll
Opis zachowania:创建可执行文件
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe
C:\Program Files\Microsoft\DesktopLayer.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Opis zachowania:覆盖已有文件
Szczegóły:C:\Program Files\Microsoft\px3.tmp
C:\Program Files\Internet Explorer\dmlconf.dat
Opis zachowania:复制文件
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> C:\Program Files\Microsoft\DesktopLayer.exe
Opis zachowania:内存映射方式修改可执行文件
Szczegóły:C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll
Opis zachowania:删除文件
Szczegóły:C:\Program Files\Microsoft\px3.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFB26.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1766.tmp
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\favicon[1].ico
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Opis zachowania:查找文件
Szczegóły:FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe
FileName = C:\Program Files\Internet Explorer\IEXPLORE.EXE
FileName = C:\Program Files\Internet Explorer\iexplore.exe
FileName = C:\*.*
FileName = C:\222c25ed\*.*
FileName = C:\222c25ed\IE8-Setup-Full\*.*
FileName = C:\222c25ed\IE8-Setup-Full\log\*.*
FileName = C:\AnalyzeControl\*.*
FileName = C:\DiskD\*.*
FileName = C:\DiskX\*.*
FileName = C:\DiskX\RECYCLER\*.*
FileName = C:\Documents and Settings\*.*
FileName = C:\Documents and Settings\Administrator\*.*
Opis zachowania:设置特殊文件夹属性
Szczegóły:C:\DiskX\RECYCLER
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\Administrator\IECompatCache
Opis zachowania:修改文件内容
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> Offset = 0
C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 0
C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 4096
C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 8192
C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 12288
C:\Program Files\Internet Explorer\dmlconf.dat ---> Offset = 0
C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.privateSurf\0.0.0.1\backgroundpage.html ---> Offset = 2787
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BC2F4288-4F9A-11E9-91C0-7B****28}.dat ---> Offset = 512
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BC2F4288-4F9A-11E9-91C0-7B****28}.dat ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFB26.tmp ---> Offset = 16383
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFB26.tmp ---> Offset = 12288
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BC2F4288-4F9A-11E9-91C0-7B****28}.dat ---> Offset = 3072
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{BC2F4288-4F9A-11E9-91C0-7B****28}.dat ---> Offset = 1536
C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.quicklink\0.0.0.1\backgroundpage.html ---> Offset = 873
C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.quicklink\0.0.0.1\popup.html ---> Offset = 39547
Zachowanie sieci
Opis zachowania:下载文件
Szczegóły:URLDownloadToFileW: http://ww****om/favicon.ico ---> C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Opis zachowania:连接指定站点
Szczegóły:InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000
InternetConnectA: ServerName = ur****om, PORT = 443, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000200
Opis zachowania:打开HTTP连接
Szczegóły:InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004
InternetOpenA: UserAgent: VCSoapClient, hSession = 0x00cc0010
Opis zachowania:建立到一个指定的套接字连接
Szczegóły:URL: fg****om, IP: **.133.40.**:443, SOCKET = 0x000000a8
URL: go****om, IP: **.133.40.**:80, SOCKET = 0x000000ac
URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000444
URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000578
URL: ur****om, IP: **.133.40.**:443, SOCKET = 0x0000059c
Opis zachowania:读取网络文件
Szczegóły:hFile = 0x00cc000c, BytesToRead =2048, BytesRead = 2048.
hFile = 0x00cc0018, BytesToRead =4095, BytesRead = 4095.
Opis zachowania:发送HTTP包
Szczegóły:GET / HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Accept-Encoding: gzip, deflate Host: ww****om Connection: Keep-Alive
GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive
Opis zachowania:打开HTTP请求
Szczegóły:HttpOpenRequestA: ww****om:80/, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400200
HttpOpenRequestA: ww****om:80/favicon.ico, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00600010
HttpOpenRequestA: ur****om:443/urs.asmx?msurs-client-key=1/obu63nmivxmiw76fuz2a%3d%3d&msurs-patented-lock=bvsbunz4dmm%3d, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: POST, Referer: , Flags = 0x04880300
Opis zachowania:按名称获取主机地址
Szczegóły:gethostbyname: fg****om
gethostbyname: go****om
GetAddrInfoW: ww****om
GetAddrInfoW: ur****om
Zachowanie rejestru
Opis zachowania:修改注册表
Szczegóły:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Recovery\Active\{BC2F4288-4F9A-11E9-91C0-7B****28}
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\Enable
\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32\
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Main\Window_Placement
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTime
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeCount
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Count
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DBC80044-A445-435B-BC74-9C25C1C588A9}\iexplore\Time
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\InprocServer32\ThreadingModel
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\
Opis zachowania:删除注册表键值
Szczegóły:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Opis zachowania:删除注册表键
Szczegóły:\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{CAFEEFAC-0017-0000-FFFF-ABCDEFFEDCBA}\
\REGISTRY\USER\S-*_CLASSES\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\InprocServer32\
\REGISTRY\USER\S-*_CLASSES\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\
\REGISTRY\USER\S-*_CLASSES\JavaPlugin.1000\CLSID\
Opis zachowania:修改注册表_启动项
Szczegóły:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
Inne zachowanie
Opis zachowania:创建互斥体
Szczegóły:KyUffThOkYwRRtgPP
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
MSCTF.Shared.MUTEX.IOH
Local\!BrowserEmulation!SharedMemory!Mutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
RasPbFile
ConnHashTable<2768>_HashTable_Mutex
MSCTF.Shared.MUTEX.EOJ
Opis zachowania:隐藏指定窗口
Szczegóły:[Window,Class] = [,ComboLBox]
[Window,Class] = [详细信息,Button]
[Window,Class] = [,BrowserFrameGripperClass]
[Window,Class] = [缩放级别,ToolbarWindow32]
[Window,Class] = [,msctls_progress32]
[Window,Class] = [,SysLink]
[Window,Class] = [,Static]
[Window,Class] = [http://www.yixun.com/ - Windows Internet Explorer,IEFrame]
[Window,Class] = [文件大小未知,Static]
[Window,Class] = [,UniversalSearchBand]
[Window,Class] = [,TravelBand]
[Window,Class] = [,CommandBarClass]
[Window,Class] = [,ReBarWindow32]
[Window,Class] = [,TabBandClass]
[Window,Class] = [打开此类文件前总是询问(&W),Button]
Opis zachowania:查找指定窗口
Szczegóły:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [Static,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
Opis zachowania:窗口信息
Szczegóły:Pid = 2528, Hwnd=0x1033c, Text = 计算结果, ClassName = Button(GroupBox).
Pid = 2528, Hwnd=0x1033e, Text = 操作, ClassName = Button(GroupBox).
Pid = 2528, Hwnd=0x10340, Text = 文件名:, ClassName = Static.
Pid = 2528, Hwnd=0x10344, Text = CRC 值:, ClassName = Static.
Pid = 2528, Hwnd=0x10348, Text = MD5 值:, ClassName = Static.
Pid = 2528, Hwnd=0x1034c, Text = 读速度:, ClassName = Static.
Pid = 2528, Hwnd=0x10350, Text = 详细信息, ClassName = Button.
Pid = 2528, Hwnd=0x10352, Text = 状态:, ClassName = Static.
Pid = 2528, Hwnd=0x10356, Text = 把 CRC 校验值放入文件名中, ClassName = Static.
Pid = 2528, Hwnd=0x10358, Text = 执行, ClassName = Button.
Pid = 2528, Hwnd=0x1035a, Text = 创建 SFV 文件, ClassName = Static.
Pid = 2528, Hwnd=0x1035c, Text = 执行, ClassName = Button.
Pid = 2528, Hwnd=0x1035e, Text = 创建 MD5 文件, ClassName = Static.
Pid = 2528, Hwnd=0x10360, Text = 执行, ClassName = Button.
Pid = 2528, Hwnd=0x10362, Text = 优先级, ClassName = Static.
Opis zachowania:获取TickCount值
Szczegóły:TickCount = 276250, SleepMilliseconds = 60000.
TickCount = 276265, SleepMilliseconds = 60000.
TickCount = 276281, SleepMilliseconds = 60000.
TickCount = 276296, SleepMilliseconds = 60000.
TickCount = 276312, SleepMilliseconds = 60000.
TickCount = 276328, SleepMilliseconds = 60000.
Opis zachowania:调整进程token权限
Szczegóły:SE_LOAD_DRIVER_PRIVILEGE
Opis zachowania:打开事件
Szczegóły:HookSwitchHookEnabledEvent
MSFT.VSA.COM.DISABLE.2528
MSFT.VSA.IEC.STATUS.6c736db0
CTF.ThreadMIConnectionEvent.000007E8.00000000.0000000F
CTF.ThreadMarshalInterfaceEvent.000007E8.00000000.0000000F
MSCTF.SendReceiveConection.Event.IOH.IC
MSCTF.SendReceive.Event.IOH.IC
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
Isolation Signal Registry Event (BC2F4285-4F9A-11E9-91C0-7B****28, 0)
Global\SvcctrlStartEvent_A3752DX
\INSTALLATION_SECURITY_HOLD
Isolation Signal Registry Event (BC2F4286-4F9A-11E9-91C0-7B****28, 0)
IE_EarlyTabStart_0xad4
_fCanRegisterWithShellService
MSFT.VSA.COM.DISABLE.2768
Opis zachowania:修改后的可执行文件签名信息
Szczegóły:C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll(签名验证: 未通过)
Opis zachowania:可执行文件签名信息
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe(签名验证: 未通过)
C:\Program Files\Microsoft\DesktopLayer.exe(签名验证: 未通过)
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico(签名验证: 未通过)
Opis zachowania:调用Sleep函数
Szczegóły:[1]: MilliSeconds = 60000.
[2]: MilliSeconds = 0.
Opis zachowania:创建事件对象
Szczegóły:EventName = Isolation Signal Registry Event (BC2F4285-4F9A-11E9-91C0-7B****28, 0)
EventName = IE_EarlyTabStart_0xad4
EventName = Isolation Signal Registry Event (BC2F4286-4F9A-11E9-91C0-7B****28, 0)
EventName = DINPUTWINMM
EventName = Global\userenv: User Profile setup event
EventName = MSCTF.SendReceive.Event.EOJ.IC
EventName = MSCTF.SendReceiveConection.Event.EOJ.IC
EventName = Local\RSS Eventing Event Event 00000ad0
EventName = IEFrame.EventCheckDefaultBrowser
EventName = Local\afc_29
EventName = Global\crypt32LogoffEvent
Opis zachowania:可执行文件MD5
Szczegóły:C:\Documents and Settings\Administrator\Local Settings\%temp%\996ESrv.exe ---> ff5e1f27193ce51eec318714ef038bef
C:\Program Files\Microsoft\DesktopLayer.exe ---> ff5e1f27193ce51eec318714ef038bef
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico ---> fe1d0ee5901dd167ee9b28eece31786c
Opis zachowania:打开互斥体
Szczegóły:ShimCacheMutex
Local\_!MSFTHISTORY!_
Local\c:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Local\c:!documents and settings!administrator!cookies!
Local\c:!documents and settings!administrator!local settings!history!history.ie5!
Local\WininetStartupMutex
Local\WininetConnectionMutex
Local\WininetProxyRegistryMutex
Local\!BrowserEmulation!SharedMemory!Mutex
Local\!IETld!Mutex
RasPbFile
CtfmonInstMutexDefaultS-*
Local\RSS Eventing Connection Database Mutex 00000ad0
Local\c:!documents and settings!administrator!local settings!application data!microsoft!feeds cache!
Local\!IECompat!Mutex
Opis zachowania:修改后的可执行文件MD5
Szczegóły:C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll ---> c2552ed659a01da4c46d241fdae8b206
Opis zachowania:查找文件方式探测虚拟机
Szczegóły:FindFirstFileEx: FileName = C:\Documents and Settings\Administrator\Local Settings\Application Data\VMware\*.*
FindFirstFileEx: FileName = C:\Documents and Settings\Administrator\Local Settings\Temp\VMwareDnD\*.*
Uruchom zrzut ekranu
VirSCAN

O VirSCAN | Polityka prywatności | Kontakt z nami | Przyjazny link | Pomóż VirSCAN
Przetłumaczony przez Łukasz 'ZeeWolf' Kieres, Polska
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号