1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:80 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 565592d342e241eb6fca351f9c810ae3 |
| file type: | Nsis |
| Production company: | Piriform Ltd |
| version: | 2.0.0.0---2.0.0.0 |
| Shell or compiler information: | |
| Subfile information: | CCleaner64.exe / big file / EXE |
| CCleaner.exe / db1654adb276501c44db0fe5e8a0841d / EXE | |
| PF-Toolbar-W78.exe / c5628cd068bb80ab24b741ffe4042138 / Nsis | |
| PF-Chrome-W78.exe / 989cba8f5ae4fb9574379c28729ce849 / Nsis | |
| GoogleUpdateSetup_1.3.21.123.exedumpFile / 82683411c04a7e11c93628a32a8b80f7 / EXE | |
| GoogleUpdateSetup_1.3.21.123.exedumpFile / 82683411c04a7e11c93628a32a8b80f7 / EXE | |
| gcapi_dll.dll / d496480a00abde0655c0fdce9530b43e / DLL | |
| uninst.exe / f7eff976455b0911933484ad7687e726 / Nsis | |
| pfWWW.dll / 1bf8a77ace38e746320dc8d67b2e7236 / DLL | |
| [NSIS].nsi / 267cb698b5a055dcfdd373816ef5056f / Unknown | |
| gtapi_signed.dll / 61bc40d1fad9e0faa9a07219b90ba0e4 / DLL | |
| lang-1043.dll / 167982b7385ff805f63d60821021dcad / DLL | |
| lang-1032.dll / f4aa27b162b3edb280fa6bff61d37718 / DLL | |
| lang-1034.dll / 3f02a380229c88048dfad216ac6ae9a5 / DLL | |
| lang-1036.dll / 3e02ed6637de2f6e423d02decf45a6ff / DLL | |
| lang-1027.dll / 34232c9b0b181d19c69db989006b3529 / DLL | |
| lang-1109.dll / a98e8c6ad027f3d46ac303c0a8e6bdb2 / DLL | |
| lang-9999.dll / 7e516044ddd1b752fe1f34ad6366728b / DLL | |
| lang-3098.dll / 0617b95c40cb9b578b0a6fa78b2ff079 / DLL | |
| Key behavior | |
|---|---|
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,Button] |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500 |
| MSCTF.MarshalInterface.FileMap.APK..GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.B.GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.C.GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.D.GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.E.GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.F.GJKHF | |
| MSCTF.MarshalInterface.FileMap.APK.G.GJKHF | |
| Behavior description: | 创建可执行文件 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\System.dll |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\UserInfo.dll | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gtapi_signed.dll | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcapi_dll.dll | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\pfWWW.dll | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\ButtonEvent.dll | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\nsDialogs.dll | |
| Behavior description: | 修改文件内容 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcombo\ComboOffer.html---> Offset = 0 |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcombo\combo-offer.png---> Offset = 16384 | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-header.bmp---> Offset = 0 | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-wizard.bmp---> Offset = 0 | |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar\test |
| Behavior description: | 删除注册表键值 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar\test |
| \REGISTRY\MACHINE\SOFTWARE\Google\No Toolbar Offer Until\Piriform Ltd | |
| \REGISTRY\MACHINE\SOFTWARE\Google\No Chrome Offer Until\Piriform Ltd | |
| Behavior description: | 删除注册表键 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar |
| Other behavior | |
|---|---|
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 |
| CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500 | |
| MSCTF.Shared.MUTEX.AEH | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,Button] |
| Behavior description: | 打开图片文件 |
| details: | \DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-header.bmp |
| \DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-wizard.bmp | |
| Behavior description: | 获取系统权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Run screenshot |
|---|
 |
HOME
