CF免费领枪软件.exe

Sherry.ai

CF免费领枪软件.exe

b573684723

好压火绒扫描MISS

EAVKILL

Heavev

过360     套装

XywCloud

巡警启发杀

蓝天二号

这程序 难道是数字的水军产品？？？？？？

wqcaokeyinwq

过微点扫描


双击，防火墙拦截，拒绝后，疯狂请求联网


放行，后台开始下载数据，大约10K后，此程序下载了一个微点特征库中的已知木马，随后，主防回滚母体和其他衍生物！

小鸟游真昼

MA miss

欧阳宣

to gdata

流年在消逝

avast kill

胖福

Filename: cf免费领枪软件.exe
Threat name: SONAR.Heuristic.120Full Path: Not Available

____________________________

____________________________



____________________________


cf免费领枪软件.exe Threat name: SONAR.Heuristic.120
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
cf免费领枪软件.exe

____________________________

File Actions

File: f:\norton样本\临时收集\ cf免费领枪软件.exe Threat Removed
File: c:\Users\administrator\AppData\LocalLow\SogouPY\components\ componentconfig.ini Threat Removed
____________________________

Registry Actions

Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\ SogouInput.user->SogouComponentFirstLoad:1409787100 Repaired
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\ SogouInput.user->Used:1409787100 Repaired
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\Microsoft\Multimedia\ DrawDib Threat Removed
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\Microsoft\Multimedia\ DrawDib->vga.drv 1440x900x32(BGR 0) No Action Required
Registry change: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ CF免费领枪软件_RASAPI32 Threat Removed
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->EnableFileTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->EnableConsoleTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->FileTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->ConsoleTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->MaxFileSize No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASAPI32->FileDirectory No Action Required
Registry change: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ CF免费领枪软件_RASMANCS Threat Removed
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->EnableFileTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->EnableConsoleTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->FileTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->ConsoleTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->MaxFileSize No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ CF免费领枪软件_RASMANCS->FileDirectory No Action Required
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\Microsoft\Windows\CurrentVersion\ Internet Settings->ProxyEnable:0 Repaired
Registry change: HKEY_USERS\S-1-5-21-1071228153-3121885108-811120218-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ Connections->SavedLegacySettings:... Repaired
____________________________

Network Actions

Event: Network activity (Performed by f:\norton样本\临时收集\cf免费领枪软件.exe, PID:3772) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by f:\norton样本\临时收集\cf免费领枪软件.exe, PID:3772) No action taken
(Performed by f:\norton样本\临时收集\cf免费领枪软件.exe, PID:3772) No action taken
Event: Process start: f:\norton样本\临时收集\ cf免费领枪软件.exe, PID:3772 (Performed by f:\norton样本\临时收集\cf免费领枪软件.exe, PID:3772) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available