File name: 5C39.tmp.exe Detection ratio: 4 / 56

墨家小子

SHA256:        63f9efbdc3b693ea4fb589a5528ba3009e6778bb6aacf2ce2e5072865e5417be
File name:        5C39.tmp.exe
Detection ratio:        4 / 56
Analysis date:        2016-03-24 14:54:32 UTC ( 4 minutes ago )
https://www.virustotal.com/en/file/63f9efbdc3b693ea4fb589a5528ba3009e6778bb6aacf2ce2e5072865e5417be/analysis/1458831272/

Bkav        HW32.Packed.DD00        20160324
McAfee-GW-Edition        BehavesLike.Win32.PWSZbot.fh        20160324
Qihoo-360        HEUR/QVM07.1.0000.Malware.Gen        20160324
Rising        PE:Malware.XPACK-HIE/Heur!1.9C48 [F]        20160324

saga3721

红伞云查杀 'TR/Crypt.XPACK.Gen (Cloud)' [trojan]

windows7爱好者

红伞云真快啊，可惜.....
DG断网击杀

墨家小子

windows7爱好者 发表于 2016-3-24 23:06
红伞云真快啊，可惜.....
DG断网击杀

VT云速度必须快

windows7爱好者

墨家小子 发表于 2016-3-24 23:12
VT云速度必须快

卡巴和ESET
VT-您的样本收集专家

墨家小子

windows7爱好者 发表于 2016-3-24 23:16
卡巴和ESET
VT-您的样本收集专家

大家都知道怎么回事，都别说破了，没意思了是不是

MXCERILYF!

卡巴拉黑

千骨一熊

Rising报。

嗯嗯，只看看不说话。

cfhdrty

BG[mw_shl_code=css,true]可疑文件： 5C39.tmp.exe

风险： 高
路径： D:\desktop\5C39.tmp.exe

详细信息
•    5C39.tmp.exe 程序试图修改用于在开机时启动程序的注册表设置 (\REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN)。

修改的文件
•    C:\USERS\ADMINISTRATOR\APPDATA\LOCAL\TEMP\E536\729B.BAT (created)
•    C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\CMPB9_37\DEVIDTSH.EXE (created)
•    D:\desktop\5C39.tmp.exe

修改的注册表
•    \REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\APPDATALOW\SOFTWARE\MICROSOFT\598B173F-E47C-F322-B69D-58D74A210CFB (created)
•    \REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\APPDATALOW\SOFTWARE\MICROSOFT\598B173F-E47C-F322-B69D-58D74A210CFB:Install (modified: old_value=, new_value = 000000e4 000000e3 000000ce 00000006 000000f6 00000001 00000020 00000001 0000000c 000000e1 000000b2 00000004 0000004e 00000005 00000038 00000005 000000ac 000000ed 000000a2 0000000b 000000ce 00000017 00000058 00000016 0000002c 000000c0 000000e2 00000027 0000004e 0000004a 00000058 00000052 0000002c 00000041 000000e2 000000b0 0000004f 00000026 00000059 00000066 0000002e 000000bd 000000e0 000000f0 00000048 0000009e 0000005f 000000e6 00000024 0000007d 000000eb 000000e0 0000005e 0000009e 00000040 000000a6 0000000c 0000007d 000000c0 00000020 0000003c 0000009e 00000026 00000026 0000009c 0000007d 00000042 00000020 0000005a 0000009f 0000004c 00000027 00000000 0000007f 00000086 00000022 00000052 0000009a 000000fc 00000021 00000030 00000077 000000e6 0000002a 00000012 0000009a 000000dc 00000034 000000f0 00000060 000000e6 0000001d 00000092 000000df 0000005c 0000002c 000000f0 000000f6 000000e6 000000a2 00000093 000000b1 0000005d 0000007c 000000f2 000000f2 000000e4 0000005a 00000097 00000091 00000058 0000006c 000000f0 000000d2 000000ee 000000aa 0000008c 00000071 0000004d 000000ac 00000000 00000000)
•    \REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\APPDATALOW\SOFTWARE\Microsoft (created)
•    \REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\APPDATALOW\Software (created)
•    \REGISTRY\USER\S-1-5-21-3748963782-2356946003-1565454725-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN:cmstupnp (modified: old_value=, new_value =C:\Users\Administrator\AppData\Roaming\cmpb9_37\Devidtsh.exe[/mw_shl_code]

jone_jys

擦，MES10.1无动于衷。。。