1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.
| Safety rating:85 |
| Behavior list |
| Basic Information | |
|---|---|
| MD5: | f9f3c0fdf56e117d5301feed0bce75fd |
| file type: | EXE |
| Production company: | YQSoft, Inc. |
| version: | 15.20.0.4306---15.20.0.4306 |
| Shell or compiler information: | COMPILER:Borland Delphi 6.0 - 7.0 [Overlay] |
| Key behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| MSCTF.MarshalInterface.FileMap.MBC..NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.B.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.C.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.D.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.E.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.F.NBAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.G.NBAHH | |
| MSCTF.Shared.SFM.MBC | |
| MSCTF.MarshalInterface.FileMap.MBC.H.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.I.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.J.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.K.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.L.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.M.FAFLH | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ComboLBox] |
| [Window,Class] = [安装,TApplication] | |
| [Window,Class] = [,Auto-Suggest Dropdown] | |
| Process behavior | |
|---|---|
| Behavior description: | 创建新文件进程 |
| details: | ImagePath = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-RR1DJ.tmp\996E.tmp, CmdLine = "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-RR1DJ.tmp\996E.tmp" /SL5="$202A2,6864142,119296,C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445483392.706842.exe" |
| Behavior description: | 枚举进程 |
| details: | N/A |
| File behavior | |
|---|---|
| Behavior description: | 写权限映射文件 |
| details: | CiceroSharedMemDefaultS-* |
| MSCTF.MarshalInterface.FileMap.MBC..NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.B.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.C.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.D.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.E.NAAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.F.NBAHH | |
| MSCTF.MarshalInterface.FileMap.MBC.G.NBAHH | |
| MSCTF.Shared.SFM.MBC | |
| MSCTF.MarshalInterface.FileMap.MBC.H.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.I.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.J.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.K.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.L.FAFLH | |
| MSCTF.MarshalInterface.FileMap.MBC.M.FAFLH | |
| Behavior description: | 创建可执行文件 |
| details: | C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-RR1DJ.tmp\996E.tmp |
| C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-J65LB.tmp\_isetup\_shfoldr.dll | |
| Behavior description: | 查找文件 |
| details: | FileName = C:\DOCUME~1 |
| FileName = C:\DOCUME~1\ADMINI~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1 | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-RR1DJ.tmp | |
| FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-RR1DJ.tmp\996E.tmp | |
| FileName = C:\Documents and Settings | |
| FileName = C:\Documents and Settings\Administrator | |
| FileName = C:\Documents and Settings\Administrator\「开始」菜单 | |
| FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序 | |
| FileName = C:\*.* | |
| Other behavior | |
|---|---|
| Behavior description: | 创建互斥体 |
| details: | CTF.LBES.MutexDefaultS-* |
| CTF.Compart.MutexDefaultS-* | |
| CTF.Asm.MutexDefaultS-* | |
| CTF.Layouts.MutexDefaultS-* | |
| CTF.TMD.MutexDefaultS-* | |
| CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-* | |
| MSCTF.Shared.MUTEX.ELH | |
| MSCTF.Shared.MUTEX.MBC | |
| Behavior description: | 隐藏指定窗口 |
| details: | [Window,Class] = [,ComboLBox] |
| [Window,Class] = [安装,TApplication] | |
| [Window,Class] = [,Auto-Suggest Dropdown] | |
| Behavior description: | 查找指定窗口 |
| details: | NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,] |
| NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,] | |
| Behavior description: | 窗口信息 |
| details: | Pid = 1384, Hwnd=0x202c2, Text = 选择安装时要使用的语言:, ClassName = TNewStaticText. |
| Pid = 1384, Hwnd=0x202d4, Text = 简体中文, ClassName = TNewComboBox. | |
| Pid = 1384, Hwnd=0x202d8, Text = 确定, ClassName = TNewButton. | |
| Pid = 1384, Hwnd=0x202d6, Text = 取消, ClassName = TNewButton. | |
| Pid = 1384, Hwnd=0x402bc, Text = 选择安装语言, ClassName = TSelectLanguageForm. | |
| Pid = 1384, Hwnd=0x302b6, Text = 欢迎使用 WinPIM 安装向导 , ClassName = TNewStaticText. | |
| Pid = 1384, Hwnd=0x502ce, Text = 现在将安装 WinPIM 到您的电脑中。 推荐您在继续安装前关闭所有其它应用程序。 单击“下一步”继续，或单击“取消”退出安装程序。, ClassName = TNewStaticText. | |
| Pid = 1384, Hwnd=0x302c4, Text = C:\Program Files\WinPIM, ClassName = TEdit. | |
| Pid = 1384, Hwnd=0x402be, Text = 下一步(&N) >, ClassName = TNewButton. | |
| Pid = 1384, Hwnd=0x202ac, Text = 取消, ClassName = TNewButton. | |
| Pid = 1384, Hwnd=0x402d6, Text = 安装 - WinPIM, ClassName = TWizardForm. | |
| Pid = 1384, Hwnd=0x102e0, Text = 选择目标位置, ClassName = TNewStaticText. | |
| Pid = 1384, Hwnd=0x102de, Text = 您想将 WinPIM 安装在什么地方？, ClassName = TNewStaticText. | |
| Pid = 1384, Hwnd=0x902d0, Text = 安装程序将安装 WinPIM 到下列文件夹中。, ClassName = TNewStaticText. | |
| Pid = 1384, Hwnd=0x3015a, Text = 单击“下一步”继续。如果您想选择其它文件夹，单击“浏览”。, ClassName = TNewStaticText. | |
| Behavior description: | 获取系统权限 |
| details: | SE_LOAD_DRIVER_PRIVILEGE |
| Behavior description: | 枚举窗口 |
| details: | N/A |
| Run screenshot |
|---|
 |
HOME
