password.exe

hx1997

https://www.virustotal.com/file/ ... e3620348c/analysis/

hxxp://professionalsinglesindian.com/images/password.exe

1654637359

bav 卡巴 扫描安全

zxcqwe

avast said:
this file is clean
I have sent it to avast as a malware.At this moment no detection has been added yet.

Dust-;羅錠

To Dr.Web

落漠

360卫士安全

利刀1937

过360杀毒

a445441

tomochan

管家无压力

free4537

过小红伞，已上报。

hddu

2014-07-29 23:56:29    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\4f33296c8eed720caa7e306e5aad6ed7\4f33296c8eed720caa7e306e5aad6ed7.exe
文件路径:C:\windows\4f33296c8eed720caa7e306e5aad6ed7.INI
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.ini


2014-07-29 23:56:30    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\4f33296c8eed720caa7e306e5aad6ed7\4f33296c8eed720caa7e306e5aad6ed7.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
触发规则:所有程序规则->Documents and Settings设置（二）->?:\Documents and Settings\*\Application Data\*


2014-07-29 23:56:30    运行应用程序      操作:允许
进程路径:C:\Documents and Settings\Administrator\桌面\4f33296c8eed720caa7e306e5aad6ed7\4f33296c8eed720caa7e306e5aad6ed7.exe
文件路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
命令行:and Settings\Administrator\桌面\4f33296c8eed720caa7e306e5aad6ed7\4f33296c8eed720caa7e306e5aad6ed7.exe
触发规则:应用程序规则->程序->?:\*


2014-07-29 23:56:30    创建文件      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
文件路径:C:\windows\cmd.INI
触发规则:所有程序规则->WINDOWS允许设置->%windir%\*.ini


2014-07-29 23:56:35    创建注册表值      操作:允许
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
注册表路径:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
注册表名称:GoogleUpdate
触发规则:所有程序规则->自动运行->*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*


2014-07-29 23:56:35    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:应用程序规则->程序->?:\*


2014-07-29 23:56:35    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:应用程序规则->程序->?:\*


2014-07-29 23:56:35    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:应用程序规则->程序->?:\*


2014-07-29 23:56:35    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:应用程序规则->程序->?:\*


2014-07-29 23:56:35    创建远程线程      操作:阻止
进程路径:C:\Documents and Settings\Administrator\Application Data\cmd.exe
目标进程:C:\WINDOWS\explorer.exe
触发规则:应用程序规则->程序->?:\*