Sunflower.exe

显示全部楼层 · 发表于 2017-7-31 22:28:14

解压密码123
http://pan.stnts.com/s/3lksJRV

显示全部楼层 · 发表于 2017-7-31 22:30:38

卡巴解压杀

显示全部楼层 · 发表于 2017-7-31 22:32:16

管家扫描Miss

显示全部楼层 · 发表于 2017-7-31 22:32:37

显示全部楼层 · 发表于 2017-7-31 22:40:13

腾讯国际版kill

显示全部楼层 · 发表于 2017-7-31 22:42:28

显示全部楼层 · 发表于 2017-7-31 22:44:41

2017-7-31 22:39:45 加载动态链接库风险级别:中允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: c:\windows\system32\dnsapi.dll
规则: [应用程序]* -> [动态链接库]c:\windows\system32\dnsapi.dll

2017-7-31 22:39:45 创建文件风险级别:未知允许
进程: d:\program files\fscapture8.4_chs\fscapture.exe
目标: C:\Documents and Settings\Administrator\桌面\2017-07-31_223943.png
规则: [应用程序组]a028_《低受限组》_ProgramData -> [文件]c:\documents and settings\*\桌面\*

2017-7-31 22:39:52 访问网络允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: TCP [本机 : 4460] -> [45.33.9.234 : 80 (http)]
规则: [应用程序]*.exe -> [网络]任意协议 [本机 : 任意端口] <-> [任意地址 : 任意端口]

2017-7-31 22:39:52 创建文件风险级别:未知允许
进程: d:\program files\fscapture8.4_chs\fscapture.exe
目标: C:\Documents and Settings\Administrator\桌面\2017-07-31_223950.png
规则: [应用程序组]a028_《低受限组》_ProgramData -> [文件]c:\documents and settings\*\桌面\*

2017-7-31 22:40:11 创建新进程风险级别:未知阻止
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: c:\windows\system32\ntvdm.exe
命令行: "C:\WINDOWS\system32\ntvdm.exe" -f -i1 -o
规则: [应用程序]* -> [子应用程序]→a002_《禁运程序_不受信任组》_潜在不受欢迎的木马病毒 -> [应用程序]*\ntvdm.exe

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: d:\program files\fscapture8.4_chs\fscapture.exe
目标: C:\Documents and Settings\Administrator\桌面\2017-07-31_224003.png
规则: [应用程序组]a028_《低受限组》_ProgramData -> [文件]c:\documents and settings\*\桌面\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\layoc984.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\layoc984.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\layout.bin
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\datac984.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\datac984.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\data1.hdr
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\datac994.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\datac994.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\data1.cab
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setuc9a3.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setuc9a3.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setup.exe
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\_Setc9a3.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\_Setc9a3.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\_Setup.dll
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\ISSec9c2.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\ISSec9c2.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\ISSetup.dll
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setuc9d2.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setuc9d2.rra
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setup.ini
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:11 修改文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Program Files\InstallShield Installation Information\{526CB7FA-5A34-092A-A565-901201502099}\setup.ini
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\program files\installshield installation information\*\*

2017-7-31 22:40:20 创建文件夹风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Documents and Settings\All Users\「开始」菜单\程序\Pomegranate Blossom Puzzle Game
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\documents and settings\*\「开始」菜单\程序

2017-7-31 22:40:20 创建文件风险级别:未知允许
进程: d:\program files\fscapture8.4_chs\fscapture.exe
目标: C:\Documents and Settings\Administrator\桌面\2017-07-31_224018.png
规则: [应用程序组]a028_《低受限组》_ProgramData -> [文件]c:\documents and settings\*\桌面\*

2017-7-31 22:40:27 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Documents and Settings\All Users\「开始」菜单\程序\Pomegranate Blossom Puzzle Game\SugarMaple.lnk
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件]c:\documents and settings\all users\「开始」菜单\程序\*\*; *.lnk

2017-7-31 22:40:33 创建文件风险级别:未知允许
进程: c:\documents and settings\administrator\桌面\sunflower.exe
目标: C:\Documents and Settings\All Users\桌面\SugarMaple.lnk
规则: [应用程序组]→a999_★《临时规则_安装软件》★ -> [文件组]《拦截》f100_桌面快捷方式

显示全部楼层 · 发表于 2017-7-31 23:02:46

fsp应该是过了没反应，HMP解压提示，双击提示！

显示全部楼层 · 发表于 2017-7-31 23:17:34

毒霸扫描miss

显示全部楼层 · 发表于 2017-7-31 23:24:38

本帖最后由 zst470396853 于 2017-7-31 23:26 编辑

360 Q管国际版扫描miss
运行 kill

[可疑文件] Sunflower.exe

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源