流氓软件

zq19861019

AVA 25.8127
GD 25.7640

*** Process ***

Process: 13104
File name: rundll32.exe
Path: c:\windows\syswow64\rundll32.exe

Publisher: Microsoft Windows
Creation date: 05/14/16 13:26:58
Modification date: 10/29/14 01:40:50

Started by: xappllv.dll
Publisher: ShenZhen Thunder Networking Technologies Ltd.


*** Actions ***

The program has executed actions in the name of another program.
A packer was run on the program file, possibly to conceal malicious content.
The program establishes a network connection.
An unknown process was accessed.
The program has created or manipulated an executable file.
The program can be used to execute any program code.
The program has read data from its own program file.


*** Quarantine ***

The following files were moved into quarantine:
c:\sandbox\琪\virus\user\all\thunder network\downloadlib\pub_store.dat
c:\sandbox\琪\virus\user\current\appdata\local\microsoft\windows\inetcache\counters.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\alltipscfg.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\code\cmdengine\2039\dcp8624.tmp
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\code\cmdengine\2277\dcp8644.tmp
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\code\cmdengine\dcp8613.tmp
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\code\cmdengine\dcp8623.tmp
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\code\cmdengine\dcp8645.tmp
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\temp\index_v2.1.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\temp\tasklist_v2.1.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappcloud\cloudhistory_v1.1.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappcloud\cloudinfo.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappcloud\smartindex_v1.1.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappdc\gcollecttask.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappod\b1de1668_0f4d_47b2_8b18_3a32a1d69c6d_v1.2.od
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappres\preresindex_v1.1.dat
c:\sandbox\琪\virus\user\public\thunder network\kankan\xapp\xappres\resconfig.dat

The following registry entries were deleted:

\registry\user\sandbox_琪_virus\user\current\software\microsoft\windows\currentversion\internet settings\connections || savedlegacysettings
\registry\user\sandbox_琪_virus\user\current\software\microsoft\windows\currentversion\internet settings || proxyserver
\registry\user\sandbox_琪_virus\user\current_classes\local settings\software\microsoft\windows\shell\muicache\c:\sandbox\琪\virus\user\current\appdata\local\temp\is-1idag.tmp || 知网数据下载器v1.0.1_2.tmp.friendlyappname

YGLh1oJpsHLCLyYmJ/zAcoJygmJi0HKCYmJyguBygnJycnJwKnSiQicndJJwKycqJycnCcdykmJicpKAKycnJycmBvhygg25YuHWgvaQLieHcnJycgeacnJycmJioConDcpy8nJycuKgLScpJykmBptywmJicsLAKieLcnIsJ8nALycoJiYnCI1yknJycoLQKycoJiYnCI9ykiYn6HKC8CknJyYmJwd3KicHhy0nJycnJgaXLScnJycmBqcrGH41ZiwoG4c1ZionGH41ZiwHpy0nKSYmJwmnLifXcNtycnJyYmJw+3KSKCcuJ6hw7HKSYmJyknD8cnIqJyonZ3COcvIL5yonJyYmJwfnLicNaCknh4D7cnJiYnJyAAA
Rules version: 5.0.118
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 63860

RunDll32.exe "C:\Users\Public\Thunder Network\KanKan\Pusher\xappdisp.2.0.0.90.dll",NewTipsMain /src:explorer64
MD5: 8BFE805555CDAF6387912A34D7978DAA
"C:\Windows\SysWOW64\rundll32.exe" "C:\Users\Public\Thunder Network\KanKan\Pusher\xappllv.dll",RunDllWithFix xappdisp.dll,NewTipsMain /src:explorer64
MD5:

轩夏

MSE miss