Detection ratio: 3 / 54 加入启动项、键盘记录、联网送快递……

墨家小子

SHA256:        1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531
File name:        1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531.exe
Detection ratio:        3 / 54
Analysis date:        2015-12-02 01:56:51 UTC ( 0 minutes ago )
https://www.virustotal.com/en/fi ... nalysis/1449021411/



2015/12/2 9:57:25,C:\Windows\explorer.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\Desktop\1111\1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531.exe" )

2015/12/2 9:57:29,C:\Users\AAAAAA\Desktop\1111\1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Local\TempFix All Windows.exe" )

2015/12/2 9:57:31,C:\Users\AAAAAA\Desktop\1111\1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Local\TempFix All Windows.exe" )

2015/12/2 9:57:38,C:\Users\AAAAAA\Desktop\1111\1a21ffc02ba39f7f1463a6b1e461c58b7318e2c954d8165d5814c4643d7f4531.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Local\Tempaldalam.exe" )

2015/12/2 9:57:41,C:\Users\AAAAAA\AppData\Local\Tempaldalam.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Roaming\svchost.exe" )

2015/12/2 9:57:44,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,53,Blocked ;Execution of an application (netsh firewall add allowedprogram "C:\Users\AAAAAA\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE)

2015/12/2 9:57:46,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 9:57:50,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,41,Blocked ;Modifying protected file (C:\Users\AAAAAA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\23556fb1360f366337f97c924e76ead3.exe)

2015/12/2 9:57:53,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,17,Blocked ;Recording keyboard input

2015/12/2 9:57:56,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 9:57:59,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,50,Allowed ;Accessing the network via DNSResolver service

2015/12/2 9:58:00,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 9:58:08,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,48,Allowed ;Outgoing network access

2015/12/2 9:58:10,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,18,Blocked ;Recording keyboard input

2015/12/2 9:58:11,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 9:58:13,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 9:58:17,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Terminated ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

steven_lzs

卡巴杀了。

蓝天二号

GD  Miss

双击。。

wjy19800315

蓝天二号 发表于 2015-12-2 10:08
GD  Miss

双击。。

数字拉黑

XywCloud

SUD to BAV

胖福

双击过SONAR，自动防护杀掉一个衍生物！


文件名: tempaldalam.exe
威胁名称: SAPE.Heur.84830完整路径: c:\users\administrator\appdata\local\tempaldalam.exe

____________________________

____________________________


在电脑上的创建时间 
2015-12-2 ( 10:25:03 )

上次使用时间 
2015-12-2 ( 10:27:05 )

启动项目 
否

已启动 
否

威胁类型: 启发式病毒。 根据恶意软件启发式技术检测威胁。

____________________________


tempaldalam.exe 威胁名称: SAPE.Heur.84830
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
tempaldalam.exe

____________________________

文件操作

文件: c:\users\administrator\appdata\local\ tempaldalam.exe 已删除
____________________________


文件指纹 - SHA:
af6d7557419eb894e8e9333216fa082911b4ba3bb66e55bafee33607f47ef4cf
文件指纹 - MD5:
不可用

驭龙

ESS MISS

pal家族

Kaspersky
UDS:DangerousObject.Multi.Generic

samlin01

红伞kill

为你心碎

AVAST