VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

  Main Menu
VirSCAN  HOME VirSCAN  go Virscan.org VirSCAN  Report VirSCAN  Virus report VirSCAN  Behavior report VirSCAN  Help VirSCAN VirSCAN  Submit Bugs VirSCAN  Contact us VirSCAN  URL detection VirSCAN  API VirSCAN  uploader for windows(test)
  Powered By
a-squared
a-squared
a-squared
 
File information
Safety rating:75
Behavior list
Basic Information
MD5:788d14cd12c04bc3ce49cca6abdae132
file type:Rar
Production company:
version:
Shell or compiler information:
Subfile information:Resident Evil 6 v1.0-1.0.6.165 Plus 14 Trainer.exe / 2fc5a63846dc628b1e4388bd676037dd / EXE
下载说明.txt / 7010eb5c22aa4738f69f004b4591a83d / Unknown
游民星空 Gamersky.com.url / 1e2afd10cc59022d1a1e5e5955785cda / Unknown
Key behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerBGM.mid
VIDEOMEMORY
AMResourceMapping2-0x0000-0x0000051e
MSCTF.MarshalInterface.FileMap.EOB..ADCHH
MSCTF.MarshalInterface.FileMap.EOB.B.ADCHH
MSCTF.MarshalInterface.FileMap.EOB.C.AECHH
MSCTF.MarshalInterface.FileMap.EOB.D.AECHH
MSCTF.MarshalInterface.FileMap.EOB.E.AECHH
MSCTF.MarshalInterface.FileMap.EOB.F.AECHH
MSCTF.MarshalInterface.FileMap.EOB.G.AECHH
MSCTF.Shared.SFM.EOB
MSCTF.MarshalInterface.FileMap.EOB.H.GOELH
MSCTF.MarshalInterface.FileMap.EOB.I.GOELH
MSCTF.MarshalInterface.FileMap.EOB.J.GOELH
Behavior description:屏蔽窗口关闭消息
details:hWnd = 0x000302a6, Text = FLiNG"s Trainer, ClassName = #32770.
Behavior description:获取窗口截图信息
details:Foreground window Info: HWND = 0x24010301, DC = 0x24010301.
Foreground window Info: HWND = 0x0101038b, DC = 0x0101038b.
Foreground window Info: HWND = 0x030104d2, DC = 0x030104d2.
Process behavior
Behavior description:枚举进程
details:N/A
File behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerBGM.mid
VIDEOMEMORY
AMResourceMapping2-0x0000-0x0000051e
MSCTF.MarshalInterface.FileMap.EOB..ADCHH
MSCTF.MarshalInterface.FileMap.EOB.B.ADCHH
MSCTF.MarshalInterface.FileMap.EOB.C.AECHH
MSCTF.MarshalInterface.FileMap.EOB.D.AECHH
MSCTF.MarshalInterface.FileMap.EOB.E.AECHH
MSCTF.MarshalInterface.FileMap.EOB.F.AECHH
MSCTF.MarshalInterface.FileMap.EOB.G.AECHH
MSCTF.Shared.SFM.EOB
MSCTF.MarshalInterface.FileMap.EOB.H.GOELH
MSCTF.MarshalInterface.FileMap.EOB.I.GOELH
MSCTF.MarshalInterface.FileMap.EOB.J.GOELH
Behavior description:修改文件内容
details:C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerSettings.ini---> Offset = 0
C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerSettings.ini---> Offset = 40
C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerSettings.ini---> Offset = 57
C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerSettings.ini---> Offset = 75
C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerSettings.ini---> Offset = 20
C:\Documents and Settings\Administrator\My Documents\FLiNGTrainer\TrainerBGM.mid---> Offset = 0
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\Version
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{31345649-0000-0010-8000-00AA00389B71}\FriendlyName
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{31345649-0000-0010-8000-00AA00389B71}\CLSID
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{31345649-0000-0010-8000-00AA00389B71}\FilterData
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{31345649-0000-0010-8000-00AA00389B71}\ClassManagerFlags
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{A2551F60-705F-11CF-A424-00AA003735BE}\FriendlyName
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{A2551F60-705F-11CF-A424-00AA003735BE}\CLSID
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{A2551F60-705F-11CF-A424-00AA003735BE}\FilterData
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{083863F1-70DE-11D0-BD40-00A0C911CE86}\{A2551F60-705F-11CF-A424-00AA003735BE}\ClassManagerFlags
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\FriendlyName
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\CLSID
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\FilterData
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device\MidiOutId
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device\FriendlyName
\REGISTRY\USER\S-*\Software\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device\CLSID
Behavior description:删除注册表键值
details:\REGISTRY\USER\S-*\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache\1
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
AMResourceMutex2
VideoRenderer
eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-*
MSCTF.Shared.MUTEX.ELH
MSCTF.Shared.MUTEX.EOB
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
Behavior description:获取系统权限
details:SE_LOAD_DRIVER_PRIVILEGE
SE_INC_BASE_PRIORITY_PRIVILEGE
Behavior description:屏蔽窗口关闭消息
details:hWnd = 0x000302a6, Text = FLiNG"s Trainer, ClassName = #32770.
Behavior description:窗口信息
details:Pid = 508, Hwnd=0x302a6, Text = FLiNG"s Trainer, ClassName = #32770.
Behavior description:获取窗口截图信息
details:Foreground window Info: HWND = 0x24010301, DC = 0x24010301.
Foreground window Info: HWND = 0x0101038b, DC = 0x0101038b.
Foreground window Info: HWND = 0x030104d2, DC = 0x030104d2.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

 pol

京公网安备 11010802020746号