1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
4, If your browser cannot upload files, please download VirSCAN uploader to upload.
| Virscan.org multi-engine scan report |
| Behavior analysis report: Habo file analysis |
| MD5:8e6f9448bf36d26a216f60a14b98f291 |
| 文件大小:5.58MB |
| 上传时间: 2014-09-22 10:36:30 (CST) |
| Package names: |
| Minimum operating environment: |
| copyright: |
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| MSCTF.MarshalInterface.FileMap.IEG..PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.B.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.C.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.D.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.E.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.F.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.G.PHHHH | |
| Local\UrlZonesSM_Administrator | |
| Behavior description: | 在桌面创建快捷方式 |
| details: | C:\Documents and Settings\Administrator\桌面\Lantern.lnk |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,Button] |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Run\Lantern |
| Behavior description: | 创建新文件进程 |
| details: | ImagePath = C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.exe, CmdLine = "C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.exe" |
| Behavior description: | 枚举进程 |
| details: | N/A |
| Behavior description: | 在系统敏感位置（如开始菜单等)释放链接或快捷方式 |
| details: | C:\Documents and Settings\Administrator\「开始」菜单\程序\Lantern\Lantern.lnk |
| C:\Documents and Settings\Administrator\「开始」菜单\程序\Lantern\Uninstall Lantern.lnk | |
| Behavior description: | 创建可执行文件 |
| details: | C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.exe |
| C:\Documents and Settings\Administrator\Application Data\Lantern\uninstall.exe | |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nss5.tmp\ShellExecAsUser.dll | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\Documents and Settings |
| FileName = C:\Documents and Settings\Administrator | |
| FileName = C:\Documents and Settings\Administrator\Local Settings | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\Temp | |
| FileName = C:\Documents and Settings\Administrator\Local Settings\%temp% | |
| FileName = C:\Documents and Settings\Administrator\Application Data | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Lantern | |
| FileName = C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.exe | |
| FileName = C:\Documents and Settings\Administrator\My Documents | |
| FileName = C:\Documents and Settings\All Users | |
| FileName = C:\Documents and Settings\All Users\Documents | |
| FileName = C:\Documents and Settings\Administrator\桌面 | |
| FileName = C:\Documents and Settings\All Users\桌面 | |
| FileName = C:\Documents and Settings\Administrator\「开始」菜单 | |
| FileName = C:\Documents and Settings\All Users\「开始」菜单 | |
| Behavior description: | 在桌面创建快捷方式 |
| details: | C:\Documents and Settings\Administrator\桌面\Lantern.lnk |
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| MSCTF.MarshalInterface.FileMap.IEG..PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.B.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.C.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.D.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.E.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.F.PHHHH | |
| MSCTF.MarshalInterface.FileMap.IEG.G.PHHHH | |
| Local\UrlZonesSM_Administrator | |
| Behavior description: | 修改文件内容 |
| details: | C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.ico---> Offset = 0 |
| C:\Documents and Settings\Administrator\Application Data\Lantern\.packaged-lantern.yaml---> Offset = 0 | |
| C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.yaml---> Offset = 98304 | |
| C:\Documents and Settings\Administrator\「开始」菜单\程序\Lantern\Lantern.lnk---> Offset = 0 | |
| C:\Documents and Settings\Administrator\「开始」菜单\程序\Lantern\Uninstall Lantern.lnk---> Offset = 0 | |
| C:\Documents and Settings\Administrator\桌面\Lantern.lnk---> Offset = 0 | |
| C:\WINDOWS\wininit.ini---> Offset = 0 |
| Behavior description: | 修改注册表 |
| details: | \REGISTRY\USER\S-*\Software\Lantern\ |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\DisplayName | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\DisplayIcon | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\Publisher | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\URLInfoAbout | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\DisplayVersion | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern\UninstallString | |
| \REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\Documents and Settings\Administrator\Application Data\Lantern\lantern.exe | |
| \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\PendingFileRenameOperations | |
| Behavior description: | 删除注册表键值_删除启动项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Run\value |
| Behavior description: | 修改注册表_启动项 |
| details: | \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Run\Lantern |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| Behavior description: | 窗口信息 |
| details: | Pid = 1124, Hwnd=0x202cc, Text = 关闭(&L), ClassName = Button. |
| Pid = 1124, Hwnd=0x202b4, Text = 取消(&C), ClassName = Button. | |
| Pid = 1124, Hwnd=0x202d6, Text = Nullsoft Install System v2.46 , ClassName = Static. | |
| Pid = 1124, Hwnd=0x202d8, Text = Nullsoft Install System v2.46, ClassName = Static. | |
| Pid = 1124, Hwnd=0x302da, Text = 显示细节(&D), ClassName = Button. | |
| Pid = 1124, Hwnd=0x202b0, Text = 抽取: lantern.exe... 100%, ClassName = Static. | |
| Pid = 1124, Hwnd=0x202a4, Text = Lantern 安装: 正在安装, ClassName = #32770. | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,Button] |
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.ELH | |
| Local\ZonesCounterMutex | |
| Local\ZoneAttributeCacheCounterMutex | |
| Local\ZonesCacheCounterMutex | |
| Local\ZonesLockedCacheCounterMutex | |
| Behavior description: | 获取系统权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
HOME
