VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

File information
Safety rating:75
Behavior list
Basic Information
MD5:e6c65aab5278f9b3cb990a7b49a1e552
file type:EXE
Production company:suprxx
version:1.0.20.0---1.0.20
Shell or compiler information:COMPILER:Microsoft Visual Studio .NET 2005 -- 2008 -> Microsoft Corporation [Overlay] *
Key behavior
Behavior description:修改注册表_系统防火墙可信进程列表
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\PPRX\pprx.exe
Behavior description:进程提权信息
details:NT AUTHORITY\SYSTEM
Process behavior
Behavior description:隐藏窗口创建进程
details:ImagePath = C:\Program Files\PPRX\pprx.exe, CmdLine = "C:\Program Files\PPRX\pprx.exe"
Behavior description:创建进程
details:ImagePath = C:\WINDOWS\system32\msiexec.exe, CmdLine = "C:\WINDOWS\system32\msiexec.exe" /i "C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\PPRX-ai2.msi" AI_SETUPEXEPATH="C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe" SETUPEXEDIR=
ImagePath = C:\Program Files\PPRX\pprx.exe, CmdLine = "C:\Program Files\PPRX\pprx.exe"
Behavior description:创建本地线程
details:TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1980, StartAddress = 4AEA7456, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 388, StartAddress = 004785E3, Parameter = 0053E56C
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 164, StartAddress = 004899C2, Parameter = 0012F7F0
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1996, StartAddress = 004899C2, Parameter = 0012F7F0
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1360, StartAddress = 00488BA5, Parameter = 0012F48C
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1408, StartAddress = 0046ECA5, Parameter = 0012FB14
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 556, StartAddress = 0045E8D0, Parameter = 00BD75E8
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 764, StartAddress = 7CAA203B, Parameter = 7CB75F50
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 744, StartAddress = 765E964D, Parameter = 001B4B80
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 2044, StartAddress = 7C949B6F, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 468, StartAddress = 759D8761, Parameter = 00000000
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 672, StartAddress = 757D4D37, Parameter = 001F3F68
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1952, StartAddress = 757D4D37, Parameter = 001F3F68
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 1808, StartAddress = 757D4D37, Parameter = 001F21F0
TargetProcess: %temp%\****.exe, InheritedFromPID = 1944, ProcessID = 896, ThreadID = 300, StartAddress = 757D4D37, Parameter = 001F21F0
Behavior description:枚举进程
details:N/A
Behavior description:进程提权信息
details:NT AUTHORITY\SYSTEM
File behavior
Behavior description:创建文件
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\holder0.aiph
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\PPRX-ai2.msi
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4C.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4E.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab50.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar51.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\51c3e2.msi
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab52.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar53.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab54.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar55.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab56.tmp
Behavior description:创建可执行文件
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\pprx.exe
Behavior description:覆盖已有文件
details:C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4C.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4E.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab50.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar51.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\51c3e2.msi
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab52.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar53.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab54.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar55.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab56.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar57.tmp
Behavior description:复制文件
details:C:\Program Files\PPRX\start.vbs ---> C:\Program Files\PPRX\start.vbs.back
Behavior description:删除文件
details:C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4C.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4E.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab50.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar51.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab52.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar53.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab54.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar55.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab56.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar57.tmp
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\holder0.aiph
C:\Documents and Settings\Administrator\Local Settings\Temp\51c3e2.msi
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll
Behavior description:查找文件
details:FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Application Data
FileName = C:\WINDOWS\system32\msi.dll
FileName = \\?\C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll
FileName = \\?\C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\
FileName = \\?\C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7
FileName = \\?\C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\
FileName = C:\Documents and Settings\Administrator\Application Data\suprxx
FileName = C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install
FileName = C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7
FileName = C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\PPRX-ai2.msi
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\Certificates\*
FileName = C:\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My\CRLs\*
Behavior description:修改BAT脚本文件
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\start.vbs ---> Offset = 0
C:\Program Files\PPRX\start.vbs ---> Offset = 0
Behavior description:修改文件内容
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll ---> Offset = 0
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll ---> Offset = 65536
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\PPRX-ai2.msi ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4C.tmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp ---> Offset = 32768
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp ---> Offset = 65536
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4D.tmp ---> Offset = 98304
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab4E.tmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp ---> Offset = 32768
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp ---> Offset = 65536
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar4F.tmp ---> Offset = 98304
C:\Documents and Settings\Administrator\Local Settings\Temp\Cab50.tmp ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temp\Tar51.tmp ---> Offset = 0
Network behavior
Behavior description:连接指定站点
details:WinHttpConnect: ServerName = ai****om, PORT = 80, UserName = , Password = , hSession = 0x02602000, hConnect = 0x02602100, Flags = 0x00000000
WinHttpConnect: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x02602000, hConnect = 0x02602100, Flags = 0x00000000
WinHttpConnect: ServerName = ai****om, PORT = 80, UserName = , Password = , hSession = 0x01aa2000, hConnect = 0x01aa2100, Flags = 0x00000000
WinHttpConnect: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x01aa2000, hConnect = 0x01aa2100, Flags = 0x00000000
Behavior description:打开HTTP连接
details:WinHttpOpen: UserAgent: Microsoft-CryptoAPI/5.131.2600.5512, hSession = 0x02602000
WinHttpOpen: UserAgent: Microsoft-CryptoAPI/5.131.2600.5512, hSession = 0x01aa2000
Behavior description:建立到一个指定的套接字连接
details:URL: w****., IP: **.133.40.**:80, SOCKET = 0x0000045c
URL: w****., IP: **.133.40.**:80, SOCKET = 0x00000454
URL: ai****om, IP: **.133.40.**:80, SOCKET = 0x00000458
URL: w****., IP: **.133.40.**:80, SOCKET = 0x00000504
URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000458
URL: w****., IP: **.133.40.**:80, SOCKET = 0x0000031c
URL: w****., IP: **.133.40.**:80, SOCKET = 0x00000324
URL: ai****om, IP: **.133.40.**:80, SOCKET = 0x00000320
URL: w****., IP: **.133.40.**:80, SOCKET = 0x00000328
URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000324
Behavior description:发送HTTP包
details:GET /wpad.dat HTTP/1.1 Accept: */* User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: **.133.40.** Connection: Keep-Alive
GET /certs/ca.crt HTTP/1.1 Accept: */* User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: ai****om Connection: Keep-Alive
GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1 Accept: */* User-Agent: Microsoft-CryptoAPI/5.131.2600.5512 Host: ww****om Connection: Keep-Alive Cache-Control: no-cache Pragma: no-cache
Behavior description:打开HTTP请求
details:WinHttpOpenRequest: ai****om:80/certs/ca.crt, hConnect = 0x02602100, hRequest = 0x02630000, Verb: GET, Referer: , Flags = 0x00000000
WinHttpOpenRequest: ww****om:80/msdownload/update/v3/static/trustedr/en/authrootseq.txt, hConnect = 0x02602100, hRequest = 0x02630000, Verb: GET, Referer: , Flags = 0x00000100
WinHttpOpenRequest: ai****om:80/certs/ca.crt, hConnect = 0x01aa2100, hRequest = 0x01b10000, Verb: GET, Referer: , Flags = 0x00000000
WinHttpOpenRequest: ww****om:80/msdownload/update/v3/static/trustedr/en/authrootseq.txt, hConnect = 0x01aa2100, hRequest = 0x01b10000, Verb: GET, Referer: , Flags = 0x00000100
Behavior description:按名称获取主机地址
details:gethostbyname: w****.
GetAddrInfoW: ai****om
GetAddrInfoW: ww****om
GetAddrInfoW: ht****rg
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\USER\S-*\Software\Caphyon\Advanced Installer\TXT Updater Config\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\C:\Program Files\PPRX\start.vbs
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\EnableUPnP
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\1900:UDP
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\2869:TCP
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\AllowExceptions
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\AllowInboundRouterRequest
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\IcmpSettings\AllowInboundRouterRequest
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\AllowRedirect
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\IcmpSettings\AllowRedirect
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\AllowUnicastResponses
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableUnicastResponsesToMulticastBroadcast
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\Registered Applications\pprn
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\8080:TCP
\REGISTRY\MACHINE\SOFTWARE\Caphyon\Advanced Installer\Windows Firewall\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\Registered Ports\pprnp
Behavior description:删除注册表键值
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\pprx\DEBUG\Trace Level
Behavior description:修改注册表_系统防火墙可信进程列表
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files\PPRX\pprx.exe
Behavior description:删除注册表键
details:\REGISTRY\USER\S-*\Software\Caphyon\Advanced Installer\TXT Updater Config\{1AB3506A-892D-437A-9C63-22B2A0EEB9F7}\
\REGISTRY\USER\S-*\Software\Caphyon\Advanced Installer\TXT Updater Config\
\REGISTRY\USER\S-*\Software\Caphyon\Advanced Installer\
\REGISTRY\USER\S-*\Software\Caphyon\
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
MSCTF.Shared.MUTEX.ELH
RasPbFile
Global\_MSIExecute
CTF.LBES.MutexDefaultS-1-5-18
CTF.Compart.MutexDefaultS-1-5-18
CTF.Asm.MutexDefaultS-1-5-18
CTF.Layouts.MutexDefaultS-1-5-18
CTF.TMD.MutexDefaultS-1-5-18
CTF.TimListCache.FMPDefaultS-1-5-18MUTEX.DefaultS-1-5-18
Behavior description:创建事件对象
details:EventName = Advinst_9EA71ABFA25A40AD88410F9286DE72E1
EventName = 896_uigo_evt
EventName = 896_uidone_evt
EventName = 896_mdl_evt
EventName = 896_sho_evt
EventName = 896_edlg_evt
EventName = 896_ddlg_evt
EventName = Global\crypt32LogoffEvent
EventName = Global\userenv: User Profile setup event
EventName = DINPUTWINMM
EventName = DisableLowDiskWarning
EventName = MSCTF.SendReceive.Event.ABG.IC
EventName = MSCTF.SendReceiveConection.Event.ABG.IC
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
Behavior description:调整进程token权限
details:SE_LOAD_DRIVER_PRIVILEGE
SE_SHUTDOWN_PRIVILEGE
SE_INCREASE_QUOTA_PRIVILEGE
SE_CREATE_TOKEN_PRIVILEGE
Behavior description:打开事件
details:HookSwitchHookEnabledEvent
_fCanRegisterWithShellService
CTF.ThreadMIConnectionEvent.000007B4.00000000.0000003F
CTF.ThreadMarshalInterfaceEvent.000007B4.00000000.0000003F
MSCTF.SendReceiveConection.Event.ELH.IC
MSCTF.SendReceive.Event.ELH.IC
Global\crypt32LogoffEvent
Global\userenv: Machine Group Policy has been applied
userenv: User Group Policy has been applied
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
\INSTALLATION_SECURITY_HOLD
Global\SvcctrlStartEvent_A3752DX
MSFT.VSA.COM.DISABLE.796
MSFT.VSA.IEC.STATUS.6c736db0
MSFT.VSA.COM.DISABLE.2244
Behavior description:可执行文件签名信息
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll(签名验证: 通过)
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\pprx.exe(签名验证: 未通过)
Behavior description:隐藏指定窗口
details:[Window,Class] = [Skip,Button]
[Window,Class] = [Cancel,Button]
Behavior description:可执行文件MD5
details:C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll ---> 4678e8d9ffea477eb266574e20d84ffd
C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\0EEB9F7\pprx.exe ---> 文件过大!
Behavior description:打开互斥体
details:ShimCacheMutex
RasPbFile
Local\!IETld!Mutex
Behavior description:加载新释放的文件
details:Image: C:\Documents and Settings\Administrator\Application Data\suprxx\ShareWithUsXP 1.0.20\install\decoder.dll.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号