VirSCAN VirSCAN

1, U kunt elk bestandstype UPLOADEN, bestandsgrootte max. 20 Mb.
2, VirSCAN ondersteunt Rar/Zip decompressie, max. 20 bestanden per Rar/Zip
3, VirSCAN kan Rar/Zip bestanden scannen die beveiligd zijn met wachtwoord 'infected' of 'virus'.

Taal
Serverbelasting
Server Load

Bestandsinformatie
Veiligheidsclassificatie:87
Gedragslijst
Gedragsanalyse rapport:         Threatbook file behaviour analysis report
Basis informatie
MD5:1e02d6aa4a199448719113ae3926afb2
Bestandstype:Nsis
Productie bedrijf:
versie:
Shell- of compiler-informatie:
Subfile-informatie:DeltaTB.exedumpFile / eb2764885565b6c01cb32e5f51f213b3 / EXE
DeltaTB.exe / eb2764885565b6c01cb32e5f51f213b3 / EXE
Unlocker.exedumpFile / 0ed06220bc07ec9a5d8807f9d5c0d9f0 / EXE
Unlocker.exe / 0ed06220bc07ec9a5d8807f9d5c0d9f0 / EXE
modern-wizard.bmpdumpFile / cbe40fd2b1ec96daedc65da172d90022 / Unknown
modern-wizard.bmp / cbe40fd2b1ec96daedc65da172d90022 / Unknown
UnlockerAssistant.exedumpFile / 255e405d801cf01247390f38f92d8042 / EXE
UnlockerAssistant.exe / 255e405d801cf01247390f38f92d8042 / EXE
[NSIS].nsidumpFile / 56b3a4a1eacb184ef2f155a00bef57b0 / Unknown
[NSIS].nsi / 2f3d27e5bc3f12e2dba4ed4854692c54 / Unknown
InstallOptions.dlldumpFile / 325b008aec81e5aaa57096f05d4212b5 / DLL
InstallOptions.dll / 325b008aec81e5aaa57096f05d4212b5 / DLL
UnlockerInject32.exedumpFile / 5b964dbcc99edee45a6f235417713a93 / EXE
UnlockerInject32.exe / 5b964dbcc99edee45a6f235417713a93 / EXE
System.dlldumpFile / c17103ae9072a06da581dec998343fc1 / DLL
System.dll / c17103ae9072a06da581dec998343fc1 / DLL
UnlockerCOM.dlldumpFile / 49b6af547ed4ba1fb07bf6f384fda841 / DLL
UnlockerCOM.dll / 49b6af547ed4ba1fb07bf6f384fda841 / DLL
delta_logo_small.bmpdumpFile / a65d47e65c637df50385873a205739b9 / Unknown
Sleutelgedrag
Gedrag beschrijving:隐藏指定窗口
Voor meer informatie:[Window,Class] = [,ComboLBox]
[Window,Class] = [,Button]
[Window,Class] = [Nullsoft Install System v2.46,Static]
[Window,Class] = [Nullsoft Install System v2.46 ,Static]
[Window,Class] = [,Static]
Bestand gedrag
Gedrag beschrijving:创建可执行文件
Voor meer informatie:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\System.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\LangDLL.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\InstallOptions.dll
Gedrag beschrijving:修改文件内容
Voor meer informatie:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\Delta.ini---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\Delta.ini---> Offset = 26
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\delta_logo_small.bmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\delta_logo_small.bmp---> Offset = 9254
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 36
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\modern-wizard.bmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 124
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 33
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 43
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 60
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 277
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 326
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 381
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\ioSpecial.ini---> Offset = 389
Register gedrag
Gedrag beschrijving:修改注册表
Voor meer informatie:\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\X\BaseClass
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Unlocker\Language
Ander gedrag
Gedrag beschrijving:窗口信息
Voor meer informatie:Pid = 164, Hwnd=0xb016a, Text = Chinese (Simplified), ClassName = ComboBox.
Pid = 164, Hwnd=0xc01d6, Text = OK, ClassName = Button.
Pid = 164, Hwnd=0xd01c8, Text = Cancel, ClassName = Button.
Pid = 164, Hwnd=0xc01c2, Text = Please select a language., ClassName = Static.
Pid = 164, Hwnd=0xd0180, Text = Installer Language, ClassName = #32770.
Pid = 164, Hwnd=0xe01c8, Text = &Next >, ClassName = Button.
Pid = 164, Hwnd=0xd01d6, Text = Cancel, ClassName = Button.
Pid = 164, Hwnd=0xb01b0, Text = Nullsoft Install System v2.46 , ClassName = Static.
Pid = 164, Hwnd=0xa018c, Text = Nullsoft Install System v2.46, ClassName = Static.
Pid = 164, Hwnd=0xb0170, Text = Welcome to the Unlocker 1.9.2 Setup Wizard, ClassName = Static.
Pid = 164, Hwnd=0xb01ce, Text = This wizard will guide you through the installation of Unlocker 1.9.2. It is recommended that you close all other applications, ClassName = Static.
Pid = 164, Hwnd=0xe0180, Text = Unlocker 1.9.2 Setup, ClassName = #32770.
Gedrag beschrijving:隐藏指定窗口
Voor meer informatie:[Window,Class] = [,ComboLBox]
[Window,Class] = [,Button]
[Window,Class] = [Nullsoft Install System v2.46,Static]
[Window,Class] = [Nullsoft Install System v2.46 ,Static]
[Window,Class] = [,Static]
Gedrag beschrijving:打开图片文件
Voor meer informatie:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\delta_logo_small.bmp
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsp4.tmp\modern-wizard.bmp
Gedrag beschrijving:获取系统权限
Voor meer informatie:SE_LOAD_DRIVER_PRIVILEGE
Screenshot uitvoeren
VirSCAN

Over VirSCAN | Privacybeleid | Neem contact met ons op | Vriendelijke link | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号