8bb4bb41b4877adfd037887e595f65b17a659c12155b9a1dc37141e5738914c6

显示全部楼层 · 发表于 2019-10-18 09:34:11

显示全部楼层 · 发表于 2019-10-18 09:47:06

显示全部楼层 · 发表于 2019-10-18 10:05:04

ESET

Win32/GenKryptik.DVRM

显示全部楼层 · 发表于 2019-10-18 10:18:58

显示全部楼层 · 发表于 2019-10-18 10:20:59

智量Heur杀，火绒Miss，有空双击。。

显示全部楼层 · 发表于 2019-10-18 10:25:50

安天和无BD管家，Both Scan Miss，双击，和同时发的另一个样本相同，会自删除，几秒后进程自动退出，两家都没反应。

显示全部楼层 · 发表于 2019-10-18 10:33:55

G DATA.

AVA 25.23715
GD 26.16332
*** Process ***
Process: 5900
File name: 2019-10-18 012215.exe
Path: C:\Users\promi\AppData\Local\Temp\BNZ.5da9245a65f39\2019-10-18 012215.exe
Publisher: Unknown publisher
Started by: Bandizip.exe
Publisher: Bandisoft
*** Actions ***
An unknown process was accessed.
The program has created or manipulated an executable file.
The program has read data from its own program file.
The program attempted to remove its own program file.
The program attempted to rename its own program file.
The program has started another program to delete itself.
The program attempted to move its own program file.
*** Quarantine ***
The following files were moved into quarantine:
C:\Users\promi\AppData\Local\Temp\BNZ.5da9245a65f39\2019-10-18 012215.exe
C:\Users\promi\AppData\Local\orgchapp\orgchapp.exe
The following registry entries were deleted:
YGLh3ZIILScnJiYnBy4nKCcnJwenQicpdJJiYnArJyknKSYGyHKScpJiYpArFt4tZ7AtJycmJicHrHKCcnJycsAvJycmJicHj3LicrJykvApJycnJyYGZyYnJyYmJwdnJycnJiYnB4crJycmJicHlyYnJycnJgaXJycnJiYnB6crGV5jKygZXmMrJxleYysHtycnJycnJgbnKCcL9yYnJyYmJwf3JycnJiYnB7gvJygnJycH6CsnKycpJwgA
Rules version: 5.0.152
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 76935
"C:\Users\promi\AppData\Local\Temp\BNZ.5da9245a65f39\2019-10-18 012215.exe"
MD5: 8957081CCCC777A3D49C3DA0ADF09B54
"C:\Program Files\Bandizip\Bandizip.exe" "C:\Users\promi\Desktop\2019-10-18 012215.rar"
MD5: 22D24F8736BA0748FBE2098416612FEF

复制代码

显示全部楼层 · 发表于 2019-10-18 10:37:08

WD扫描没反应。

显示全部楼层 · 发表于 2019-10-18 11:16:33

今天卡巴第二次 missed

显示全部楼层 · 发表于 2019-10-18 11:51:09

SEP Killed 。

[病毒样本] 8bb4bb41b4877adfd037887e595f65b17a659c12155b9a1dc37141e5738914c6