1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:20 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | ddaea3fe5b294ff399a594808d56f691 |
| file type: | DLL |
| Production company: | |
| version: | |
| Shell or compiler information: | COMPILER:Microsoft Visual C++ 6.0 DLL [Overlay] |
| Key behavior | |
|---|---|
| Behavior description: | 跨进程写入数据 |
| details: | TargetProcess = C:\WINDOWS\system32\svchost.exe, WriteAddress = 0x007a0000, Size = 0x00000027 TargetPID = 0x00000424 |
| Behavior description: | 创建远程线程 |
| details: | TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 1060, ThreadID = 2760, StartAddress = 7C801D7B, Parameter = 007A0000 |
| Process behavior | |
|---|---|
| Behavior description: | 跨进程写入数据 |
| details: | TargetProcess = C:\WINDOWS\system32\svchost.exe, WriteAddress = 0x007a0000, Size = 0x00000027 TargetPID = 0x00000424 |
| Behavior description: | 创建本地线程 |
| details: | TargetProcess: DllLoader.exe, InheritedFromPID = 2000, ProcessID = 2744, ThreadID = 2752, StartAddress = 77DC845A, Parameter = 00000000 |
| TargetProcess: DllLoader.exe, InheritedFromPID = 2000, ProcessID = 2744, ThreadID = 2756, StartAddress = 10007789, Parameter = 00000000 | |
| Behavior description: | 创建远程线程 |
| details: | TargetProcess: svchost.exe, InheritedFromPID = 652, ProcessID = 1060, ThreadID = 2760, StartAddress = 7C801D7B, Parameter = 007A0000 |
| Behavior description: | 枚举进程 |
| details: | N/A |
| Other behavior | |
|---|---|
| Behavior description: | 调整进程token权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| SE_DEBUG_PRIVILEGE | |
| Behavior description: | 检测自身是否被调试 |
| details: | IsDebuggerPresent |
| Behavior description: | 创建互斥体 |
| details: | gswbobbgyjermp |
| Global\2606023701-7 | |
| Behavior description: | 打开事件 |
| details: | HookSwitchHookEnabledEvent |
| \SECURITY\LSA_AUTHENTICATION_INITIALIZED | |
| Run screenshot |
|---|
 |
HOME
