3c3fec3cef9506c1e7d333a079384baa19b70f6ed56ec2f51485682543ac1235

www-tekeze

安天和无BD管家，Both Miss 。

Nocria

AVA 25.23536
GD 26.16138

*** Process ***

Process: 5240
File name: 019-10-02 113354.exe
Path: C:\Users\promi\AppData\Local\Temp\BNZ.5d94c4362624a\019-10-02 113354.exe

Publisher: Unknown publisher

Started by: 019-10-02 113354.exe
Publisher: Unknown publisher


*** Actions ***

An unknown process was accessed.
The program has created or manipulated an executable file.
The program attempted to remove its own program file.
The program attempted to rename its own program file.
The program attempted to move its own program file.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\promi\AppData\Local\Temp\BNZ.5d94c4362624a\019-10-02 113354.exe
C:\Users\promi\AppData\Local\movecrypto\movecrypto.exe

The following registry entries were deleted:


YGLhnIIJLScnJycmBi4nKCcnJwe5YuGcorAtJycnJyYGrHJyYmJycsAvJycnJyYGj3LCcpJyknBmcnJycmJicHZycnJyYmJwuHJycnJiYnB5cnJycmJicLqy4V5jKykb7jW2crLhXmMrCOcoJ+dwb3JycnJiYnB/cnJycmJigPtygnJycnKAvnJyKCcpJw8A
Rules version: 5.0.152
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 76935

--b07c5861
MD5: 1A41953E40C7BDD7C42993C802735B6F
"C:\Users\promi\AppData\Local\Temp\BNZ.5d94c4362624a\019-10-02 113354.exe"
MD5: 1A41953E40C7BDD7C42993C802735B6F

www-tekeze

SEP，Killed 。

暗_黑

BE_HC 发表于 2019-10-2 21:33
Norton Scan MISS

我一直在好奇，盒子是啥

静影沉璧

暗_黑 发表于 2019-10-3 08:44
我一直在好奇，盒子是啥

FortiSandbox

暗_黑

静影沉璧 发表于 2019-10-3 08:51
FortiSandbox

有下载地址吗

静影沉璧

暗_黑 发表于 2019-10-3 09:07
有下载地址吗

No，家用是不可能的

https://bbs.kafan.cn/forum.php?m ... 36&pid=43484989
https://bbs.kafan.cn/thread-2142236-1-1.html

BE_HC

暗_黑 发表于 2019-10-3 09:07
有下载地址吗

硬件来的。。。

a939707506

BD miss

暗_黑

Sophos   Troj / Emotet-BHK