#Crysis (2020-04-07)

显示全部楼层 · 发表于 2020-4-7 08:42:33

https://www.lanzous.com/ib2la8h

https://www.virustotal.com/gui/file/0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43/details

infected

复制代码

显示全部楼层 · 发表于 2020-4-7 08:44:39

本帖最后由 LSPD 于 2020-4-7 08:48 编辑

eset 清空

2020/4/7 8:47:12;文件系统实时防护;文件;C:\Users\msi\Desktop\新建文件夹 (2)\#Crysis (2020-04-07)\#Crysis (2020-04-07)\payload - upx.exe;Win32/Filecoder.Crysis.P 特洛伊木马的变种;通过删除清除;WIN-4SSFNNEKC21\msi;在应用程序新建的文件上发生事件: C:\Users\msi\Desktop\WinRAR\WinRAR.exe (290ABA06C7C55B56D4611A17F5B8063DA4DBFB17).;A76A4DA7D9F48E392EFBD36D5C6C495515457A46;2020/4/7 8:47:11
2020/4/7 8:47:15;文件系统实时防护;文件;C:\Users\msi\Desktop\新建文件夹 (2)\#Crysis (2020-04-07)\#Crysis (2020-04-07)\payload.exe;Win32/Filecoder.Crysis.P 特洛伊木马的变种;通过删除清除;WIN-4SSFNNEKC21\msi;在应用程序新建的文件上发生事件: C:\Users\msi\Desktop\WinRAR\WinRAR.exe (290ABA06C7C55B56D4611A17F5B8063DA4DBFB17).;B797000407EB333DC80777DD088204179B62FB5C;2020/4/7 8:47:11

复制代码

显示全部楼层 · 发表于 2020-4-7 08:45:18

LSPD 发表于 2020-4-7 08:44
eset

我先来，清空

显示全部楼层 · 发表于 2020-4-7 08:49:32

BEST
c:\users\jojo\desktop\#crysis (2020-04-07)\payload - upx.exe 是恶意软件 Trojan.Ransom.Crysis.E
c:\users\jojo\desktop\#crysis (2020-04-07)\payload.exe 是恶意软件 Trojan.Ransom.Crysis.E

显示全部楼层 · 发表于 2020-4-7 08:53:12

卡巴

显示全部楼层 · 发表于 2020-4-7 08:59:34

本帖最后由 CHURP 于 2020-4-7 09:02 编辑

avast清空

显示全部楼层 · 发表于 2020-4-7 09:32:32

2020/4/7 09:26:20 c:\windows\explorer.exe 创建新进程 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 允许 [应用程序]* 命令行: "C:\Users\Administrator\Desktop\#Crysis (2020-04-07)\payload - upx.exe"
2020/4/7 09:26:22 c:\windows\system32\svchost.exe 修改其他进程 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 允许 [应用程序]c:\windows\system32\svchost.exe
2020/4/7 09:26:26 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\Windows\System32\payload - upx.exe 阻止 [文件组]系统核心目录Ⅰ -> [文件]c:\windows\*; *.exe
2020/4/7 09:26:26 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\Users\Administrator\AppData\Roaming\payload - upx.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:26 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload - upx.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:26 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\payload - upx.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:37 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建新进程 c:\windows\system32\cmd.exe 允许 [应用程序组]系统程序 -> [应用程序]* -> [子应用程序]c:\windows\system32\cmd.exe 命令行: "C:\Windows\system32\cmd.exe"
2020/4/7 09:26:37 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$RGFDRDN.vbs 阻止 [文件组]文件阻止及保护 -> [文件]*; *.vbs
2020/4/7 09:26:37 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$RIY95Z0.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:37 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$ROF4PTX.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止并结束进程 [文件组]全局写入询问 -> [文件]?:\program files\*
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\autoexec.bat.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止 [文件组]文件阻止及保护 -> [文件]?:\
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 创建文件 C:\config.sys.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止 [文件组]文件阻止及保护 -> [文件]?:\
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\chrome_child.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\chrome.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\$RECYCLE.BIN\S-1-5-21-2536706165-387673494-3993502502-500\$RODFUNG.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\dotNetFx40_Full_x86_x64.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\dotnetfx45_full_4.5.51209.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\Microsoft .NET Framework 4.7_4.7.03062.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\Microsoft .NET Framework 4.8_4.8.3928.0.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\Microsoft.NET Framework_4.6.2.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\优酷客户端_7.8.2.7221.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\360Downloads\Software\漏洞补丁目录\install_flash_player_offline_ax_cn_32.0.0.142_360_22b836a4e9cb41fb0c1b6d48af5a5d52061dda7d.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\plugins\ThunderXWebUpdate\dist\_nuxt\vendor.7de319e99a941be0c70a.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\plugins\ThunderXWebXDAS\versions\4.4.9\_nuxt\vendor.7de319e99a941be0c70a.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\out\main-renderer\renderer.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\MyDrivers\360DrvMgr\ComputerZ_HardwareDll.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\MyDrivers\360DrvMgr\DrvMgrUI.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\MyDrivers\360DrvMgr\inst_drvmgr.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\MyDrivers\update\intel_management_95151730_x86_1130.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\MyDrivers\backup\dgsetup.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Market.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AOW_Rootfs\AOW_Rootfs.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\AppMarket.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\dbgeng.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\dlcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\ffmpegsumo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GameDownload.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GF.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GF186\TUpdate.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\gmesdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\icudt.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\Common.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\qbcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\TRAE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\TBOX_32\TBOX.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AEngine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AndroidEmulator.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\TGVoiceBuddy.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AndroidEmulatorBase.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\SSOPlatform.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\Common.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\GF.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\dlcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\libGLES_V2_translator_v3.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TPDownLoad\plugins\TPDownload.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\d3dcompiler_43.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TerSafe.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TStats.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TPDownLoad\Tenio\TenioDL\p2papp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\UI.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\VDI\VDI.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\vcredist.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\Temp\TxGameDownload\Component\VDI\Setup\tbox-img.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\node.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\MediaInfo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\ffmpeg.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\installer\setup.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\libglesv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\sesafe.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\swiftshader\libglesv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\download\3.2.1.47\download\download_engine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\npflash\29_0_0_171\NPSWF32_29_0_0_171.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\ppflash\29_0_0_171\pepflashplayer32_29_0_0_171.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\360极速浏览器\360cse_9.5.0.138.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\dbgeng.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\dgcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\dghelper.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\dgres.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\drivergenius.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\filece.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\ksoft\kbootoptpop.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\ksoft\kbootopt.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\nicdrv.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\pnpsup.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\security\ksde\dgdecs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\usbpnp.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\DriverGenius\xlmodule\download\download_engine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\Office 2007@23577_35197.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\Office 2007@23577_35197.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\d3dcompiler_43.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:41 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\windows\system32\cmd.exe 创建新进程 c:\windows\system32\mode.com 允许 [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\* 命令行: mode con cp select=1251
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\SDK\DownloadSDK.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\SDK\xsdn.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\libcef.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\PepperFlash\pepflashplayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderRepair.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderStart.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderUninstall.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XDASKernel.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XLLiveUD.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\xluagc.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\APlayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\SDK\DownloadSDK.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\SDK\xsdn.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\XmpPlayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Thunder BHO Platform\np_tdieplat.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 E:\迅雷下载\Thunder\Thunder BHO Platform\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libcef.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libEGL.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libEGL.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\widevinecdmadapter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\widevinecdmadapter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencrypthelperapp.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencrypthelperapp.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencryptshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencryptshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docersoso\docersosoclient.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docersoso\docersosoclient.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docpermission\docpermission.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencryptshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docencryptshellext\docencryptshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docersoso\docersososerver.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docersoso\docersososerver.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kaiwpp\kaiwpp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cloudpushsdk\cloudpushsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cloudpushsdk\cloudpushsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kaiwps\kaiwps.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kaiwps\kaiwps.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kappcenter\kappcenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kappcenter\kappcenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kautofindcontents\kautofindcontents.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kautofindcontents\kautofindcontents.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kbrowser\kbrowser.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kbrowser\kbrowser.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kclouddocs\kclouddocs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kclouddocs\kclouddocs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kdcsdk\kdcsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kdcsdk\kdcsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kdocerpage\kdocerpage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kdocerpage\kdocerpage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kfeedback\kfeedback.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kfeedback\kfeedback.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\khelp\khelp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\khelp\khelp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kjsapipage\kjsapipage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kjsapipage\kjsapipage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\knewdocs\knewdocs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\knewdocs\knewdocs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\konlinefonts\konlinefonts.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\knewshare\knewshare.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\knewshare\knewshare.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\konlineshapes\konlineshapes.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\koptioncenter\koptioncenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\koptioncenter\koptioncenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2docentrylist\kpdf2docentrylist.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2docentrylist\kpdf2docentrylist.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2wordshellext\kpdf2wordshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2wordshellext\kpdf2wordshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2wordshellext\kpdf2wordshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdfcontextmenushellext\kpdfcontextmenushellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdf2wordshellext\kpdf2wordshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdfcontextmenushellext\kpdfcontextmenushellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpluginrunner\kpluginrunner.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdfcontextmenushellext\kpdfcontextmenushellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpdfcontextmenushellext\kpdfcontextmenushellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpluginrunner\kpluginrunner.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeprocesson\kpromeprocesson.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeprocesson\kpromeprocesson.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeshowtime\kpromeshowtime.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeshowtime\kpromeshowtime.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromebrowser\kpromebrowser.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromebrowser\kpromebrowser.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromewebstartup\kpromewebstartup.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromewebstartup\kpromewebstartup.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kquickview\kquickviewapp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeworkarea\kpromeworkarea.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kpromeworkarea\kpromeworkarea.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kstartpage\kstartpage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kskincenter\kskincenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kskincenter\kskincenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\ksslinker\ksslinker.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\ksslinker\ksslinker.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\ktaskschdtool\ktaskschdtool.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\ktaskschdtool\ktaskschdtool.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwhatsnew\kwhatsnew.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kusercenter\kusercenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwhatsnew\kwhatsnew.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kusercenter\kusercenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwpsnote\kwpsnote.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwpsnote\kwpsnote.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\messagecenter\messagecenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\messagecenter\messagecenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\messagepush\messagepush.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\messagepush\messagepush.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwpsassistlegacy\kwpsassistlegacy.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kwpsassistlegacy\kwpsassistlegacy.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\multiclipboard\multiclipboard.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\multiclipboard\multiclipboard.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\officespace\officespace.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo\kximagemodule.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo\photo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo\kximagemodule.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo2pdfshellext\photo2pdfshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo2pdfshellext\photo2pdfshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo2pdfshellext\photo2pdfshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo2pdfshellext\photo2pdfshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\qing\qingbangong.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\apilogserver.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\aeocenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\aeocenter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\authmain.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\authmain.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\wpsshowtimeapp\wpsshowtimeapp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\addons\wpsshowtimeapp\wpsshowtimeapp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\avcodec-57.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\auth.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\authsvr.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\auth.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\authsvr.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\avutil-55.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\avutil-55.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\cfgs\oeminfo\oem.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\cfgs\oeminfo\oem.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\avformat-57.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\avformat-57.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\cswrapper11.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\cswrapper.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\cswrapper11.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\cswrapper.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\curls.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\curls.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\dbghelp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\dbghelp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\docwriter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\etapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\etmain.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\et.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\et.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ethtmrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ethtmrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ethtmlrw2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\excel2003htmlrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\etxmlrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\excelrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ethtmlrw2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\excel2003htmlrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\etxmlrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\friso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\griddrawer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\friso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\griddrawer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\htmlpub.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\htmlpub.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\html2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\html2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\iconv.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\inkobj.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\iconv.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\inkobj.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jsetapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\inkobj4xp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\IRLAS.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\IRLAS.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jswpsapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jscommon.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\jscommon.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\inkobj4xp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kbrowserclient.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kbrowserclient.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kcefrender.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kcefrender.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kcrashdumper.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jswppapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kcrashdumper.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\jswppapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kde.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kcrashdumper64.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kde.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kcrashdumper64.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kdynsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\khomepage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kdownload.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kinfosdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kdynsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kdownload.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\khomepage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kinfosdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kprometheus.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kpdffeedback.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kpdffeedback.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\krpt.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\krecentfile.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\krpt.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\krecentfile.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksaddndr.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksmso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kqingaccountsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ksaddndr.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ksmso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kqingaccountsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksoapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksolaunch.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksolite.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\KSOXMLED.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\KSOXMLED.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kwhatnewdlg.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kwhatnewdlg.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsartstyleborder.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsartstyleborder.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\KSOXEV64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\KSOXEV64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsaccountsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsaccountsdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksomisc.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ksomisc.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\libeay32.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\libeay32.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsinspector.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\kwpsinspector.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\mediacoder.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\mediacoder.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\libmipush.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\libmipush.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\mediaplayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ltkrn12n.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\mediaplayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\ltkrn12n.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\lttwn12n.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\lttwn12n.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\msvcm90.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\msvcm90.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\msvcp100.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\msvcp100.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\msvcr100.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\msvcr100.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\msvcr90.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:26:47 c:\users\administrator\desktop\#crysis (2020-04-07)\payload - upx.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\msvcr90.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:28 c:\windows\explorer.exe 创建新进程 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 允许 [应用程序]* 命令行: "C:\Users\Administrator\Desktop\#Crysis (2020-04-07)\payload.exe"
2020/4/7 09:30:30 c:\windows\system32\svchost.exe 修改其他进程 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 允许 [应用程序]c:\windows\system32\svchost.exe
2020/4/7 09:30:38 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\Windows\System32\payload.exe 阻止 [文件组]系统核心目录Ⅰ -> [文件]c:\windows\*; *.exe
2020/4/7 09:30:38 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\Users\Administrator\AppData\Roaming\payload.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:38 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:38 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建新进程 c:\windows\system32\cmd.exe 允许 [应用程序组]系统程序 -> [应用程序]* -> [子应用程序]c:\windows\system32\cmd.exe 命令行: "C:\Windows\system32\cmd.exe"
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\chrome.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\chrome_child.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\installer\setup.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\libglesv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\sesafe.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\11.0.2216.0\swiftshader\libglesv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\download\3.2.1.47\download\download_engine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\npflash\29_0_0_171\NPSWF32_29_0_0_171.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360Chrome\Chrome\Application\components\ppflash\29_0_0_171\pepflashplayer32_29_0_0_171.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$RGFDRDN.vbs 阻止 [文件组]文件阻止及保护 -> [文件]*; *.vbs
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$RIY95Z0.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 C:\$Recycle.Bin\S-1-5-21-2536706165-387673494-3993502502-500\$ROF4PTX.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\autoexec.bat.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止 [文件组]文件阻止及保护 -> [文件]?:\
2020/4/7 09:30:45 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\$RECYCLE.BIN\S-1-5-21-2536706165-387673494-3993502502-500\$RODFUNG.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止并结束进程 [文件组]全局写入询问 -> [文件]?:\program files\*
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 创建文件 C:\config.sys.id-800F4B32.[CCD-help@protonmail.ch].ccd 阻止 [文件组]文件阻止及保护 -> [文件]?:\
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\dotnetfx45_full_4.5.51209.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\Microsoft .NET Framework 4.8_4.8.3928.0.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\Microsoft.NET Framework_4.6.2.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\Microsoft .NET Framework 4.7_4.7.03062.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\优酷客户端_7.8.2.7221.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\dotNetFx40_Full_x86_x64.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\360Downloads\Software\漏洞补丁目录\install_flash_player_offline_ax_cn_32.0.0.142_360_22b836a4e9cb41fb0c1b6d48af5a5d52061dda7d.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\MyDrivers\360DrvMgr\ComputerZ_HardwareDll.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\MyDrivers\360DrvMgr\inst_drvmgr.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\MyDrivers\360DrvMgr\DrvMgrUI.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\MyDrivers\backup\dgsetup.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\MyDrivers\update\intel_management_95151730_x86_1130.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Market.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AOW_Rootfs\AOW_Rootfs.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\out\main-renderer\renderer.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:30:48 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\plugins\ThunderXWebUpdate\dist\_nuxt\vendor.7de319e99a941be0c70a.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:30:55 c:\windows\system32\cmd.exe 创建新进程 c:\windows\system32\mode.com 允许 [应用程序组]威胁提示Ⅰ -> [应用程序]* -> [子应用程序]c:\windows\* 命令行: mode con cp select=1251
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\360极速浏览器\360cse_9.5.0.138.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\dbgeng.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\dghelper.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\dgres.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\drivergenius.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\filece.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\dgcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\ksoft\kbootopt.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\ksoft\kbootoptpop.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\nicdrv.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\pnpsup.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\security\ksde\dgdecs.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\usbpnp.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\DriverGenius\xlmodule\download\download_engine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\d3dcompiler_43.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libcef.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\AppMarket.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\Common.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\docpermission\docpermission.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\cef\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\dbgeng.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\dlcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\ffmpegsumo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GameDownload.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GF.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\GF186\TUpdate.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\gmesdk.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\icudt.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\qbcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\SSOPlatform.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\TGVoiceBuddy.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\AppMarket\Setup\TRAE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\TBOX_32\TBOX.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AEngine.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AndroidEmulator.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\AndroidEmulatorBase.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\Common.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\d3dcompiler_43.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\dlcore.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\GF.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\libGLES_V2_translator_v3.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TerSafe.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TPDownLoad\plugins\TPDownload.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TPDownLoad\Tenio\TenioDL\p2papp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\Setup\TStats.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\UI\UI.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\vcredist.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\VDI\Setup\tbox-img.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\Temp\TxGameDownload\Component\VDI\VDI.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\ffmpeg.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\MediaInfo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\node.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kaiwpp\kaiwpp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\app\plugins\ThunderXWebXDAS\versions\4.4.9\_nuxt\vendor.7de319e99a941be0c70a.js 阻止 [文件组]文件阻止及保护 -> [文件]*; *.js
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\konlinefonts\konlinefonts.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\konlineshapes\konlineshapes.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kquickview\kquickviewapp.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\kstartpage\kstartpage.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\officespace\officespace.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\photo\photo.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\addons\qing\qingbangong.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\apilogserver.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\avcodec-57.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\docwriter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\etapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\etmain.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\excelrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jsetapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\jswpsapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kprometheus.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\kso.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksoapi.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksolaunch.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\SDK\DownloadSDK.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\SDK\xsdn.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\d3dcompiler_47.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\libcef.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\libGLESv2.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\resources\bin\TBC\PepperFlash\pepflashplayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderRepair.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderStart.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\ThunderUninstall.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XLLiveUD.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\xluagc.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\ksolite.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\APlayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XDASKernel.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\SDK\DownloadSDK.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\SDK\xsdn.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Program\XMP\XmpPlayer.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Thunder BHO Platform\np_tdieplat.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 E:\迅雷下载\Thunder\Thunder BHO Platform\XLUE.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\mui\default\resource\ksee\EqnEdit.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\mui\default\resource\ksee\EqnEdit.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\mui\zh_CN\resource\ksee\EqnEdit.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\mui\zh_CN\resource\ksee\EqnEdit.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\mythes.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\mythes.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\nsemenu.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\nsemenu64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\nsemenu.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\nsemenu64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\pdfmain.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\oledefaulthandler.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\paho-mqtt3-as.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\oledefaulthandler.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\paho-mqtt3-as.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\phonon4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\photolaunch.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\phonon4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\photolaunch.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\PinyinTagger.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\PinyinTagger.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\pptreader.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\pptreader.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\pptwriter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\player.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\pptwriter.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\player.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qingnse.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qingnse64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\promecefpluginhost.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\promecefpluginhost.exe 阻止 [文件组]文件阻止及保护 -> [文件]*; *.exe
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\pptxrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\pptxrw.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qingipc.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qingshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qingipc.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qingshellext.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qingshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qingshellext64.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qcncodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qcncodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qpdfpaint.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qpdfpaint.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\QtCore4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qkrcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qjpcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qkrcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qjpcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\QtNetwork4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\QtNetwork4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\QtWebKit4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qtwcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\QtOpenGL4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\QtOpenGL4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\qt\plugins\codecs\qtwcodecs4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\QtScript4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\QtScript4.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 修改文件 D:\office\WPS Office\11.1.0.8408\office6\refEdit.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll
2020/4/7 09:30:55 c:\users\administrator\desktop\#crysis (2020-04-07)\payload.exe 删除文件 D:\office\WPS Office\11.1.0.8408\office6\refEdit.dll 阻止 [文件组]文件阻止及保护 -> [文件]*; *.dll

显示全部楼层 · 发表于 2020-4-7 09:48:16

Avira empty

显示全部楼层 · 发表于 2020-4-7 11:27:48

本帖最后由 ELOHIM 于 2020-4-7 11:29 编辑

3801187 发表于 2020-4-7 09:32
2020/4/7 09:26:20 c:\windows\explorer.exe 创建新进程 c:%users\administrator\desktop\#crysis (2020-04 ...

好长的贴子。。。
不过看样子好像没有发完，还有别的记录吗
微软：Ransom:Win32/Wadhrama

显示全部楼层 · 发表于 2020-4-7 11:29:55

ELOHIM 发表于 2020-4-7 11:27
好长的贴子。。。
不过看样子好像没有发完，还有别的记录吗
微软：Ransom:Win32/Wadhrama

发完了，直接结束进程了，无限循环没意思

[病毒样本] #Crysis (2020-04-07)

本帖子中包含更多资源

本帖子中包含更多资源