1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:76 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | 5ef7e7b8469ccd9cd1333a36caf08c0e |
| file type: | Microsoft Office Excel文档 |
| Production company: | |
| version: | |
| Shell or compiler information: | |
| Subfile information: | [5]DocumentSummaryInformation / df50f316b715e2808f989636b322e4fc / Unknown |
| [5]SummaryInformation / 2e878db9673eeaef72f4176e80907b42 / Unknown | |
| Workbook / 7a39e16c7047fbe0056633824c42cd1c / Unknown | |
| Process behavior | |
|---|---|
| Behavior description: | 创建本地线程 |
| details: | TargetProcess: EXCEL.EXE, InheritedFromPID = 2008, ProcessID = 420, ThreadID = 2516, StartAddress = 30D72B9D, Parameter = 002170C0 |
| File behavior | |
|---|---|
| Behavior description: | 创建文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1CD5.tmp |
| Behavior description: | 覆盖已有文件 |
| details: | C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Excel11.pip |
| Behavior description: | 删除文件 |
| details: | C:\Documents and Settings\Administrator\Local Settings\Temp\~DF1CD5.tmp |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Documents and Settings |
| FileName = C:\Documents and Settings\Administrator | |
| FileName = C:\Documents and Settings\Administrator\Local Settings | |
| FileName = C:\Documents and Settings\Administrator\Application Data | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Office | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\Temp | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp% | |
| Behavior description: | 复制文件 |
| details: | C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\OPA11.BAK ---> C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat |
| Registry behavior | |
|---|---|
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4080110900063D11C8EF10054038389C\Usage\ProductFiles |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\103D4\103D4 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Common\ReviewCycle\ReviewToken | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\1051C\1051C | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\+ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\) | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\w | |
| \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4080110900063D11C8EF10054038389C\Usage\ProductNonBootFiles | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\Common\Assistant\CurrAsstState | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Recent Files\File1 | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\MTTF | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\MTTA | |
| Behavior description: | 删除注册表键 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\103D4\ |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\1051C\ | |
| Behavior description: | 删除注册表键值 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\103D4\103D4 |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\+ | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\) | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\StartupItems\w | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\Resiliency\DocumentRecovery\1051C\1051C | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\Common\Assistant\CurrAsstState | |
| \REGISTRY\USER\S-*\Software\Microsoft\Office\11.0\Excel\MTTT | |
| Other behavior | |
|---|---|
| Behavior description: | 创建事件对象 |
| details: | EventName = Global\userenv: User Profile setup event |
| EventName = MSCTF.SendReceive.Event.IBF.IC | |
| EventName = MSCTF.SendReceiveConection.Event.IBF.IC | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] |
| NtUserFindWindowEx: [Class,Window] = [MsoHelp11,] | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ThunderRT6Main] |
| [Window,Class] = [Microsoft Excel,XLMAIN] | |
| Behavior description: | 创建互斥体 |
| details: | Global\MTX_MSO_Formal1_S-* |
| Global\MTX_MSO_AdHoc1_S-* | |
| OfficeAssistantStateMutex | |
| MSCTF.Shared.MUTEX.APH | |
| MSCTF.Shared.MUTEX.IBF | |
| Local\MU_ACBPIDS08 | |
| Local\MU_ACB08 | |
| Behavior description: | 窗口信息 |
| details: | Pid = 420, Hwnd=0x101bc, Text = 工作表菜单栏, ClassName = MsoCommandBar. |
| Pid = 420, Hwnd=0x101c0, Text = 格式, ClassName = MsoCommandBar. | |
| Pid = 420, Hwnd=0x101be, Text = 常用, ClassName = MsoCommandBar. | |
| Run screenshot |
|---|
 |
HOME
