1511.exe

我要打十個

http://gorkem.gozukeles.net/1511.exe

备用：

2016-11-19 20:17:31         C:\0病毒测试\1511.exe         修改注册表项         HKUS\360SandBox\S\Registry\USER\S-1-5-21-1869424861-110748379-699053083-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem

2016-11-19 20:17:02         C:\0病毒测试\1511.exe         修改文件         C:\360SANDBOX\SHADOW\ProgramData\Windows\csrss.exe

Tom179090

sep14 A杀 双击：

ese567

rising
下载完报 Downloads\1511.7z>>1511.exe   Malware.Shade!8.12CC
解压报  1511\1511.exe  Ransom.Shade!8.12CC  删除

dongwenqi

卡巴杀

诸葛亮

Filename: 1511.exe
Threat name: SONAR.AM.C!g6Full Path: Not Available

____________________________

____________________________


On computers as of 
2016/11/19 at 20:31:48

Last Used 
2016/11/19 at 20:31:48

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


1511.exe Threat name: SONAR.AM.C!g6
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
1511.exe

____________________________

File Actions

File: c:\users\m\desktop\1511\ 1511.exe Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ csrfprotector.js Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ glp Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ userlogin.cfm Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ rrc3guxmgl Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ index.php2053119282.html Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ careers_apple-touch-icon-57x57.png Threat Removed
File: c:\sandbox\m\defaultbox\user\current\appdata\local\temp\ md2q8oaepnmbogycc0o.tcrso Threat Removed
Directory: c:\Sandbox\M\defaultbox\user\current\AppData\Local\Temp\ nsmFA2B.tmp Delete Failed
Directory: c:\sandbox\m\defaultbox\user\all\ windows Threat Removed
____________________________

Network Actions

Event: Network activity (Performed by c:\users\m\desktop\1511\1511.exe, PID:10332) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\m\desktop\1511\1511.exe, PID:11516) No action taken
Event: PE file creation: c:\Sandbox\M\defaultbox\user\current\AppData\Local\Temp\nsmFA2B.tmp\ System.dll (Performed by c:\users\m\desktop\1511\1511.exe, PID:11516) No action taken
Event: Process start: c:\users\m\desktop\1511\ 1511.exe, PID:10332 (Performed by c:\users\m\desktop\1511\1511.exe, PID:11516) No action taken
Event: Process start (Performed by c:\users\m\desktop\1511\1511.exe, PID:10332) No action taken
Event: Process start: c:\users\m\desktop\1511\ 1511.exe, PID:11516 (Performed by c:\users\m\desktop\1511\1511.exe, PID:11516) No action taken
Event: PE file creation: c:\sandbox\m\defaultbox\user\all\windows\ csrss.exe (Performed by c:\users\m\desktop\1511\1511.exe, PID:10332) No action taken
Event: Process start: c:\users\m\desktop\1511\ 1511.exe, PID:10332 (Performed by c:\users\m\desktop\1511\1511.exe, PID:10332) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

wjy19800315

avast解压杀

心醉咖啡

360kill

青衣染雪

gd下载kill

Virus4

BD KILL

ELOHIM

MSE 貌似提示为：勒索。