分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-1 | 2016-09-18 09:19:06 | 2016-09-18 09:21:44 | 158 秒 |
魔盾分数
3.8
可疑的
文件详细信息
| 文件名 | updater.exe |
|---|---|
| 文件大小 | 580952 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 66e3df00feb94c09d687a6d544c1e909 |
| SHA1 | 65b97e879d4b0686be6522f0ac14b9404bcb2448 |
| SHA256 | 6da83a2308bd49d280b8e343f67da16daf9a163da3c574c5cf24df0cb4da99e7 |
| SHA512 | 99a8082f01625f692b82379cd1034fcbd5d989e35b60eb7895928d194e9330e840023523653b5b67d041490de957c7aed9d7839bd72f41f8a0c3e69f21570b2e |
| CRC32 | D994ECC4 |
| Ssdeep | 12288:qC8mYOzuvMZoCnVCpY5fsQ5ObXU1w9yt+kIIDFlD5LlR6rGmyapJNxja:qPYV1w9ytVIKld+G3abta |
| Yara | 登录查看Yara规则 |
| 样本下载 提交漏报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 93.46.8.89 | 意大利 | |
| 否 | 58.211.137.192 | 中国 | |
| 否 | 23.44.155.27 | 美国 | |
| 否 | 198.41.215.182 | 美国 | |
| 否 | 122.224.10.248 | 中国 | |
| 否 | 117.18.237.29 | 亚洲太平洋地区 |
域名解析 (可点击查询WPING实时安全评级)
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0044324d |
| 声明校验值 | 0x00094646 |
| 实际校验值 | 0x00094646 |
| 最低操作系统版本要求 | 4.0 |
| PDB路径 | C:\DistributedAutoLink\Temp\CompileOutputDir\Updater.pdb |
| 编译时间 | 2012-11-27 16:02:39 |
| 图标 |  |
| 图标精确哈希值 | dd860e178b8b34219ac2cbb573cf9a9f |
| 图标相似性哈希值 | 0f9f3e84583cfbb828f9232342d3dc9a |
版本信息
| LegalCopyright | |
|---|---|
| InternalName | |
| FileVersion | |
| CompanyName | |
| SpecialBuild | |
| ProductName | |
| ProductVersion | |
| FileDescription | |
| OriginalFilename | |
| Translation |
微软证书验证 (Sign Tool)
| SHA1 | 时间戳 | 有效性 | 错误 |
|---|---|---|---|
| 2822da5664531feee859fa34a8811c83695a3ee8 | Tue Nov 27 16:01:37 2012 | 无 |
| 证书链 | Certificate Chain 1 |
| 发行给 | VeriSign Class 3 Public Primary Certification Authority - G5 |
| 发行人 | VeriSign Class 3 Public Primary Certification Authority - G5 |
| 有效期 | Thu Jul 17 075959 2036 |
| SHA1 哈希 | 4eb6d578499b1ccf5f581ead56be3d9b6744a5e5 |
| 证书链 | Certificate Chain 2 |
| 发行给 | VeriSign Class 3 Code Signing 2010 CA |
| 发行人 | VeriSign Class 3 Public Primary Certification Authority - G5 |
| 有效期 | Sat Feb 08 075959 2020 |
| SHA1 哈希 | 495847a93187cfb8c71f840cb7b41497ad95c64f |
| 证书链 | Certificate Chain 3 |
| 发行给 | Beijing Rising Information Technology Corporation Limited |
| 发行人 | VeriSign Class 3 Code Signing 2010 CA |
| 有效期 | Tue Aug 11 075959 2015 |
| SHA1 哈希 | d9421bedd9f5b8a91dd3f8691e7a42d83c983325 |
| 证书链 | Timestamp Chain 1 |
| 发行给 | Thawte Timestamping CA |
| 发行人 | Thawte Timestamping CA |
| 有效期 | Fri Jan 01 075959 2021 |
| SHA1 哈希 | be36a4562fb2ee05dbb3d32323adf445084ed656 |
| 证书链 | Timestamp Chain 2 |
| 发行给 | VeriSign Time Stamping Services CA |
| 发行人 | Thawte Timestamping CA |
| 有效期 | Wed Dec 04 075959 2013 |
| SHA1 哈希 | f46ac0c6efbb8c6a14f55f09e2d37df4c0de012d |
| 证书链 | Timestamp Chain 3 |
| 发行给 | Symantec Time Stamping Services Signer - G3 |
| 发行人 | VeriSign Time Stamping Services CA |
| 有效期 | Tue Jan 01 075959 2013 |
| SHA1 哈希 | 8fd99d63fb3afbd534a4f6e31dacd27f59504021 |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x0006f2e6 | 0x00070000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.52 |
| .rdata | 0x00071000 | 0x0000fa1c | 0x00010000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.40 |
| .data | 0x00081000 | 0x00005910 | 0x00003000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.55 |
| .rsrc | 0x00087000 | 0x000070f8 | 0x00008000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.57 |
覆盖
| 偏移量 | 0x0008c000 |
| 大小 | 0x00001d58 |
资源
| 名称 | 偏移量 | 大小 | 语言 | 子语言 | 熵(Entropy) | 文件类型 |
|---|---|---|---|---|---|---|
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_ICON | 0x0008c838 | 0x00000468 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.67 | GLS_BINARY_LSB_FIRST |
| RT_DIALOG | 0x0008cf50 | 0x000000cc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.13 | data |
| RT_DIALOG | 0x0008cf50 | 0x000000cc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.13 | data |
| RT_STRING | 0x0008db18 | 0x000005dc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.19 | data |
| RT_STRING | 0x0008db18 | 0x000005dc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.19 | data |
| RT_STRING | 0x0008db18 | 0x000005dc | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.19 | data |
| RT_ACCELERATOR | 0x0008d020 | 0x00000070 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 2.95 | data |
| RT_GROUP_ICON | 0x00087518 | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.84 | MS Windows icon resource - 1 icon |
| RT_GROUP_ICON | 0x00087518 | 0x00000014 | LANG_CHINESE | SUBLANG_CHINESE_SIMPLIFIED | 1.84 | MS Windows icon resource - 1 icon |
| RT_VERSION | 0x0008d090 | 0x00000450 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.49 | data |
| RT_MANIFEST | 0x0008d4e0 | 0x0000024c | LANG_ENGLISH | SUBLANG_ENGLISH_US | 5.14 | XML document text |
导入
库: KERNEL32.dll:
• 0x471088 lstrcmpiA
• 0x47108c FlushFileBuffers
• 0x471090 WriteFile
• 0x471094 SetEndOfFile
• 0x471098 SetFilePointer
• 0x47109c SetFileTime
• 0x4710a0 SystemTimeToFileTime
• 0x4710a4 DeleteFileA
• 0x4710a8 SetFileAttributesA
• 0x4710ac FileTimeToSystemTime
• 0x4710b0 FindClose
• 0x4710b4 FindFirstFileA
• 0x4710b8 GetLocalTime
• 0x4710bc lstrcatA
• 0x4710c0 GetTempPathA
• 0x4710c4 GetPrivateProfileIntA
• 0x4710c8 GetDriveTypeA
• 0x4710cc WritePrivateProfileStringA
• 0x4710d0 GetLogicalDriveStringsA
• 0x4710d4 GetSystemDirectoryA
• 0x4710d8 EnterCriticalSection
• 0x4710dc LeaveCriticalSection
• 0x4710e0 FlushInstructionCache
• 0x4710e4 GetCurrentProcess
• 0x4710e8 HeapAlloc
• 0x4710ec GetPrivateProfileStringA
• 0x4710f0 GetFileSize
• 0x4710f4 GetCurrentThreadId
• 0x4710f8 GetCurrentProcessId
• 0x4710fc OutputDebugStringA
• 0x471100 GetTickCount
• 0x471104 IsBadReadPtr
• 0x471108 MultiByteToWideChar
• 0x47110c Sleep
• 0x471110 ReadFile
• 0x471114 GetVersion
• 0x471118 lstrlenW
• 0x47111c lstrcmpiW
• 0x471120 CompareStringA
• 0x471124 CompareStringW
• 0x471128 GetEnvironmentVariableA
• 0x47112c GetEnvironmentVariableW
• 0x471130 GetStringTypeExA
• 0x471134 GetStringTypeExW
• 0x471138 GlobalUnlock
• 0x47113c GlobalLock
• 0x471140 InterlockedIncrement
• 0x471144 InterlockedDecrement
• 0x471148 MulDiv
• 0x47114c LoadLibraryExA
• 0x471150 IsDBCSLeadByte
• 0x471154 GetCommandLineA
• 0x471158 ReleaseMutex
• 0x47115c GetCurrentDirectoryA
• 0x471160 SetCurrentDirectoryA
• 0x471164 CreateMutexA
• 0x471168 RemoveDirectoryA
• 0x47116c FindNextFileA
• 0x471170 GetFileAttributesA
• 0x471174 GetDiskFreeSpaceA
• 0x471178 CopyFileA
• 0x47117c SizeofResource
• 0x471180 SuspendThread
• 0x471184 MoveFileA
• 0x471188 TerminateThread
• 0x47118c OpenProcess
• 0x471190 CreateProcessA
• 0x471194 ProcessIdToSessionId
• 0x471198 GetPrivateProfileSectionA
• 0x47119c SetLastError
• 0x4711a0 lstrcpynA
• 0x4711a4 GetTempFileNameA
• 0x4711a8 lstrcmpA
• 0x4711ac LocalFree
• 0x4711b0 SetEnvironmentVariableA
• 0x4711b4 GetLocaleInfoW
• 0x4711b8 SetStdHandle
• 0x4711bc SetConsoleCtrlHandler
• 0x4711c0 IsBadCodePtr
• 0x4711c4 IsValidCodePage
• 0x4711c8 IsValidLocale
• 0x4711cc EnumSystemLocalesA
• 0x4711d0 GetUserDefaultLCID
• 0x4711d4 GetDateFormatA
• 0x4711d8 GetTimeFormatA
• 0x4711dc GetEnvironmentStringsW
• 0x4711e0 FreeEnvironmentStringsW
• 0x4711e4 GetEnvironmentStrings
• 0x4711e8 FreeEnvironmentStringsA
• 0x4711ec GetFileType
• 0x4711f0 GetStdHandle
• 0x4711f4 SetHandleCount
• 0x4711f8 UnhandledExceptionFilter
• 0x4711fc GetTimeZoneInformation
• 0x471200 GetStringTypeW
• 0x471204 GetStringTypeA
• 0x471208 GetOEMCP
• 0x47120c TlsGetValue
• 0x471210 TlsSetValue
• 0x471214 TlsFree
• 0x471218 GetCurrentThread
• 0x47121c TlsAlloc
• 0x471220 TerminateProcess
• 0x471224 IsBadWritePtr
• 0x471228 VirtualFree
• 0x47122c HeapCreate
• 0x471230 SetUnhandledExceptionFilter
• 0x471234 QueryPerformanceCounter
• 0x471238 FatalAppExitA
• 0x47123c GetCPInfo
• 0x471240 LCMapStringW
• 0x471244 LCMapStringA
• 0x471248 GetStartupInfoA
• 0x47124c CreateThread
• 0x471250 ExitThread
• 0x471254 VirtualQuery
• 0x471258 GetSystemInfo
• 0x47125c VirtualAlloc
• 0x471260 VirtualProtect
• 0x471264 GetSystemTimeAsFileTime
• 0x471268 RtlUnwind
• 0x47126c ExitProcess
• 0x471270 HeapSize
• 0x471274 HeapReAlloc
• 0x471278 CreateDirectoryA
• 0x47127c HeapDestroy
• 0x471280 WideCharToMultiByte
• 0x471284 FindResourceExA
• 0x471288 FindResourceA
• 0x47128c LoadResource
• 0x471290 ResumeThread
• 0x471294 LockResource
• 0x471298 GetLastError
• 0x47129c GetModuleHandleA
• 0x4712a0 GetModuleFileNameA
• 0x4712a4 CreateFileA
• 0x4712a8 CloseHandle
• 0x4712ac DeviceIoControl
• 0x4712b0 GetWindowsDirectoryA
• 0x4712b4 LoadLibraryA
• 0x4712b8 GetProcAddress
• 0x4712bc GlobalAlloc
• 0x4712c0 GlobalFree
• 0x4712c4 lstrcpyA
• 0x4712c8 FreeLibrary
• 0x4712cc lstrlenA
• 0x4712d0 GetProcessHeap
• 0x4712d4 HeapFree
• 0x4712d8 DeleteCriticalSection
• 0x4712dc InitializeCriticalSection
• 0x4712e0 RaiseException
• 0x4712e4 GetVersionExA
• 0x4712e8 GetThreadLocale
• 0x4712ec GetLocaleInfoA
• 0x4712f0 GetACP
• 0x4712f4 GetExitCodeThread
• 0x4712f8 InterlockedExchange
库: USER32.dll:
• 0x47136c UnregisterClassA
• 0x471370 MessageBeep
• 0x471374 SetFocus
• 0x471378 GetDlgItem
• 0x47137c SetDlgItemTextA
• 0x471380 SetWindowPos
• 0x471384 SetWindowLongA
• 0x471388 PostMessageA
• 0x47138c GetWindowTextA
• 0x471390 GetWindowTextLengthA
• 0x471394 RegisterWindowMessageA
• 0x471398 wsprintfA
• 0x47139c IsWindow
• 0x4713a0 EndDialog
• 0x4713a4 DestroyWindow
• 0x4713a8 GetWindowLongA
• 0x4713ac SetWindowTextA
• 0x4713b0 GetWindowRect
• 0x4713b4 ShowWindow
• 0x4713b8 IsWindowEnabled
• 0x4713bc EnableWindow
• 0x4713c0 GetLastActivePopup
• 0x4713c4 MessageBoxA
• 0x4713c8 IsDialogMessageA
• 0x4713cc MapWindowPoints
• 0x4713d0 GetClientRect
• 0x4713d4 SystemParametersInfoA
• 0x4713d8 GetWindow
• 0x4713dc GetParent
• 0x4713e0 CharUpperA
• 0x4713e4 FindWindowA
• 0x4713e8 wvsprintfA
• 0x4713ec DestroyIcon
• 0x4713f0 LoadIconA
• 0x4713f4 PostQuitMessage
• 0x4713f8 SendMessageA
• 0x4713fc DefWindowProcA
• 0x471400 PtInRect
• 0x471404 GetCursorPos
• 0x471408 DialogBoxParamA
• 0x47140c SetForegroundWindow
• 0x471410 KillTimer
• 0x471414 GetDlgCtrlID
• 0x471418 CharNextA
• 0x47141c GetClassNameA
• 0x471420 CreateDialogIndirectParamA
• 0x471424 GetDC
• 0x471428 ReleaseDC
• 0x47142c PeekMessageA
• 0x471430 GetMessageA
• 0x471434 TranslateMessage
• 0x471438 DispatchMessageA
• 0x47143c CharUpperW
• 0x471440 CharLowerW
• 0x471444 CharLowerA
• 0x471448 GetActiveWindow
• 0x47144c GetSystemMetrics
• 0x471450 LoadImageA
库: ADVAPI32.dll:
• 0x471000 StartServiceA
• 0x471004 CloseServiceHandle
• 0x471008 CreateProcessAsUserA
• 0x47100c GetSidLengthRequired
• 0x471010 InitializeSid
• 0x471014 GetSidSubAuthority
• 0x471018 InitializeAcl
• 0x47101c AddAce
• 0x471020 GetLengthSid
• 0x471024 CopySid
• 0x471028 IsValidSid
• 0x47102c RegEnumKeyExA
• 0x471030 RegQueryInfoKeyA
• 0x471034 RegDeleteValueA
• 0x471038 RegCreateKeyExA
• 0x47103c RegDeleteKeyA
• 0x471040 RegCreateKeyA
• 0x471044 RegSetValueExA
• 0x471048 RegQueryValueA
• 0x47104c RegOpenKeyA
• 0x471050 RegOpenKeyExA
• 0x471054 RegQueryValueExA
• 0x471058 RegCloseKey
• 0x47105c CreateServiceA
• 0x471060 OpenServiceA
• 0x471064 OpenSCManagerA
• 0x471068 QueryServiceStatus
库: SHELL32.dll:
• 0x471350 Shell_NotifyIconA
库: ole32.dll:
• 0x4714d4 PropVariantClear
• 0x4714d8 CoCreateInstance
• 0x4714dc CoUninitialize
• 0x4714e0 CoInitialize
• 0x4714e4 CoTaskMemFree
• 0x4714e8 CoTaskMemAlloc
• 0x4714ec CoTaskMemRealloc
• 0x4714f0 CoInitializeSecurity
库: OLEAUT32.dll:
• 0x471300 None
• 0x471304 None
• 0x471308 None
• 0x47130c None
• 0x471310 None
• 0x471314 None
• 0x471318 None
• 0x47131c None
• 0x471320 None
• 0x471324 None
• 0x471328 None
• 0x47132c None
• 0x471330 None
• 0x471334 None
• 0x471338 None
• 0x47133c None
• 0x471340 None
库: SHLWAPI.dll:
• 0x471358 PathRemoveFileSpecA
• 0x47135c PathSkipRootA
• 0x471360 PathFileExistsA
• 0x471364 SHStrDupW
库: COMCTL32.dll:
• 0x471070 InitCommonControlsEx
库: WININET.dll:
• 0x471468 InternetCloseHandle
• 0x47146c InternetAttemptConnect
• 0x471470 InternetConnectA
• 0x471474 InternetOpenA
• 0x471478 InternetSetOptionA
• 0x47147c InternetCrackUrlA
• 0x471480 InternetReadFile
• 0x471484 HttpQueryInfoA
• 0x471488 HttpSendRequestA
• 0x47148c HttpOpenRequestA
• 0x471490 HttpAddRequestHeadersA
库: WSOCK32.dll:
• 0x471498 None
• 0x47149c None
• 0x4714a0 None
• 0x4714a4 None
• 0x4714a8 None
• 0x4714ac None
• 0x4714b0 None
• 0x4714b4 None
• 0x4714b8 None
• 0x4714bc None
• 0x4714c0 None
• 0x4714c4 None
• 0x4714c8 None
• 0x4714cc None
库: RPCRT4.dll:
• 0x471348 UuidCreate
库: VERSION.dll:
• 0x471458 GetFileVersionInfoSizeA
• 0x47145c GetFileVersionInfoA
• 0x471460 VerQueryValueA
.text
`.rdata
@.data
.rsrc
VPQUj
T$8Rj
D$4Ph
D$8Pj
D$8Pj
D$8Pj
L$8Qj
D$ Pj
L$ Qj
t$<Vh
t$dSj
T$(Rj
u'SWj
Qh|iG
D$$Pj
Uh4 G
tUhX G
WhD G
t|Uhl G
WhD G
WhD G
D$(Pj
t$dSj
|$ Pj
T$,PhH"G
T$0Phx"G
D$\Phx"G
RPQVhx"G
L$4hL#G
D$ PhD#G
N`QWh,#G
t,Pht$G
WPh|$G
w4h(%G
T$Dhh%G
D$8@"G
WPVUj
VRSWj
VhL+G
WhH)G
F$ +G
D$0hL.G
t!h4.G
VUWPj
t$dSj
|$ Qj
u5hx/G
NWhl/G
uIhl/G
|:VhL/G
RhHNH
H%HNH
Vh 2G
Rh82G
PhD2G
T$4RPj
T$,Rh44G
u1WhH4G
Qh44G
D$T|4G
PWh\5G
D$4|4G
PWh$5G
VWh46G
Qh(6G
Qh(6G
L$hQj
L$$Qj
PVh|6G
D$hPhd6G
|$lWht7G
T$thT7G
PVh|6G
hPVWh
hPVWh
PQhX8G
T$(Rj
D$8h48G
L$@h$8G
D$ hP9G
Ph@:G
T$(RPj
\$8PSj
D$HPj
D$DhP9G
\$<PSQh
WPh82G
Sh<#G
L$(QhP<G
QShH<G
Vh0<G
ShH;G
L$@hh;G
Sh<#G
T$Lh\;G
D$|PShH;G
WQShT;G
D$H@"G
T$ hH=G
L$ h<%G
Shd>G
u9hH>G
WhpAG
QhLAG
Ph0AG
WSt h0AG
Phx@G
Ph\@G
Qhp?G
PhH?G
j&hlBG
j&hdBG
\$(t'j&h\BG
Ph<BG
j&h4BG
j&hdBG
j&h\BG
Ph<BG
j&h(BG
VWhH;G
Ph CG
EpPVj
Wh0<G
UhPVRh
T$LRPj
FpPWj
L$ h|CG
t&hpCG
L$LQPj
D$(Pj
L$ h|CG
t$hpCG
L$LQPj
L$ h|CG
t$hpCG
wBh8DG
WhT6G
QPhD#G
VWhLEG
FHPh@FG
FdPh0FG
C$PhXFG
k UhTGG
UhPGG
Wh\GG
QhTGG
QhlGG
D$0QPhxGG
GL EG
WhPFG
RPh HG
D$h EG
D$l EG
t^<<uZj
<'u!Wj
L$LQj
D$$dFG
D$xdFG
SVWUj
p`;5dVH
;=dVH
p`;5dVH
x`;=dVH
x`;=dVH
j`hhnG
j<hxnG
FVhtnG
Ph|uG
PhH/G
F95hRH
@T H
FT H
FT= H
FT H
;5dVH
;5dVH
GWhtnG
f9=RSH
95dSH
f95PSH
95lSH
95lSH
u(9=|RH
9=LUH
9=LUH
C*PjTVj
C+PjUVj
C,PjVVj
C-PjWVj
C.PjRVj
C/PjSVj
95PRH
C9=,UH
950UH
9=8UH
WSVPj
T$ Rh
T$ Rh
s`UVh
|$$vL9|$ u%Sh
L$ RUPj
t$$Wj
D$ Pj
L4(Qj
RasDialEvent
GetNetworkParams
Iphlpapi.dll
NameServer
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
System\CurrentControlSet\Services\VxD\MSTCP
list<T> too long
255.255.255.255
\system32\drivers\etc\hosts
\hosts
vector<T> too long
\\.\PhysicalDrive%d
SCSIDISK
\\.\Scsi%d:
GetAdaptersInfo
MSIE %d.%d
WININET.DLL
Windows
Windows Me
Windows 98
Windows 95
Windows NT %d.%d
%s:%d
proxy
<local>
Mozilla/4.0 (compatible; %s; %s; Rising)
Content-Type: application/x-www-form-urlencoded
InPost=
HTTP/1.0
close
Range: bytes=%d-
Host:
SystemRoot
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Group
\Rising
SHFolder.dll
SHGetFolderPathA
Shell32.dll
installpath
SOFTWARE\Rising\%s
HKEY_LOCAL_MACHINE\%s\%s
SOFTWARE\Rising
SOFTWARE\Lotus\Notes
%snserver.exe
SOFTWARE\Lotus\Notes\4.0
SOFTWARE\Lotus\Domino
%sRsTest.ini
\system32
CommonFilesDir
Software\Microsoft\Windows\CurrentVersion
\Program Files
ProgramFilesDir
nserver.exe
DataPath
%PRODUCT%
%DATADIR%
%FIRSTPART%
%COMMONDIR%
%PROGRAMDIR%
%DOMINODATA%
%DOMINODIR%
%NOTESDIR%
%WINDIR%
%SYSDIR64%
%SYSDIR%
%REGISTER%
%QUICKLAUNCH%
%DESKTOP%
%LINKS%
%INSTALL%
map/set<T> too long
invalid map/set<T> iterator
http://
datapath
[%04d-%02d-%02d][%02d:%02d:%02d:%03d]
2.log
[%04u]
[0x%08X]
[FATAL]
[ALERT]
[WAINNING]
[ACTION]
[DETAIL]
DEBUG
LOGNAME
RAV.INI
RS_DEBUG_VIEW
LOGSIZE
OUTPUT
LEVEL
Failed to CreateThread, Error = %d
Failed to CreateThread!
TIMER
TIMER_MSGBOX
Failed to load "%s"!
(1K/%dK)
(1K/1K)
(%dK/%dK)
\Microsoft\Internet Explorer\Quick Launch
\Application Data
AppData
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
\Profiles\All Users\Start Menu\Programs
Common Programs
\Start Menu\Programs
Programs
\Desktop
Desktop
SHGetSpecialFolderPathA
rasapi32.dll
System\CurrentControlSet\Services\RemoteAccess
System\CurrentControlSet\Services\RemoteAccess\Networkprovider
RasEnumEntries
RasEnumConnections
RasGetConnectStatus
RasGetEntryDialParams
RasHangUp
RasGetErrorString
RasDial
YYYIYOUDAO
comx3.dll
RS_ShutDown
RS_FreeCallCenter
RS_AllocateCallCenter
RS_UninitializeCallCenter
RS_InitializeCallCenter
&Validate=
&type=
&Time_OverTime=
&Time_Setup=
ProcID
%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X
{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
CLSID\{CAA2D3B1-4BB5-4a45-A17A-122773379D99}
GlobalUserOffline
Software\Microsoft\Windows\CurrentVersion\Internet Settings
IntervalTime
Update
%.4d-%.2d-%.2d %.2d:%.2d:%.2d
LIMIT
CLIENTNUM
SALETYPE
SNSUBTYPE
SNTYPE
ACTIONID
PRODUCTUID
RSDUPDATEXMLURL
SETUP
UPDATEXMLURL
%s\%s
NetConfig.ini
Setup
%s\Data\%s\%s.ini
%s?info=%s
%s?info=%s&ValidateInfo=%s
tag=%s&sn=%s&id=%s&ver=%s&host=%s&actionid=%s&lang=%d&validate=%d&sn_privilege=%d&sn_proname=%d&sn_protype=%d&sn_area=%d&sn_clientnum=%d&sn_limit=%d
Dial-up
ConnectionName
Password
UserName
Authentication
PROXY
NETTYPE
NetTypeNo
Failed to load %s.
Failed to read need information from %s.
Download
Finish
Validate
URLLIST
REBOOTVER
VERSION
PRODUCT
RISING
tag=%s&sn=%s&id=%s&over=%s&nver=%s&host=%s&actionid=%s&state=%s&sn_privilege=%d&sn_proname=%d&sn_protype=%d&sn_area=%d&sn_clientnum=%d&sn_limit=%d
TypeLib
Software
SYSTEM
SECURITY
Hardware
Interface
FileType
Component Categories
CLSID
AppID
Delete
NoRemove
ForceRemove
System
/SILENCE
Failed to Initialize
HKEY_CURRENT_CONFIG
HKEY_DYN_DATA
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
#32770
Updater is running!
Setup is running!
Global\
Rising_RSD_Setup_%s
Rising_RSD_Update_%s
%s\RSD%d
GetDLLObject
\RsLang.dll
Auto dial failed
Setting
DLALL
%s\%s.ini
Software\Rising\%s
CreateInstance
USEDLL
ISPROCOM
COMPONENTS
%s\xmls\setup.xml
/UPDATE
/UPDATED
Failed to InitNetwork
Not enough disk free(%d)!
Local_RSD_Update_%s
Failed to InitAppPath.
/SUBKEY
/TRAY
/lang
CommdLine: %s
kernel32.dll
GetDiskFreeSpaceExA
MACAddress
DiskSerial
Model
ProcessorId
Win32_NetworkAdapter
Win32_Processor
JrdnzoV65eg8eNgDf4oASkyp0zxCHfE0ksBJ4AwbQMlIhYMaqrLUjW1542S07mya
OOjznnTYyEHy1lGJwceypYAmFFrHAGfOAk5hy9zi6u8tcnlh3z1tTAURsCduGDzM
Invalid DateTimeSpan
Invalid DateTime
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
OpenProcessToken
Advapi32.dll
Explorer.exe
NtQuerySystemInformation
NtDll.dll
ProcessIdToSessionId
Kernel32.dll
ADVAPI32.DLL
SetNamedSecurityInfoA
Installed
Failed to call WTSQueryUserToken, err= 0x%x
WTSQueryUserToken
wtsapi32.DLL
Failed to CreateProcess: %s. LastError = %x.
Failed to LoadLibrary("Userenv.DLL"):err=0x%x
Failed to CreateProcessAsUser: %s. LastError = %x.
Successed to CreateProcessAsUser.
DestroyEnvironmentBlock
CreateEnvironmentBlock
Userenv.DLL
WinSta0\Default
file not exist : %s
succeed to download %s
Failed to download %s. hr = %d
Failed to download %s. ErrCode = %d; hr = %d
Failed to verify %s
succeed to download %s.
Error
Update exit code = 0x%.8x
Failed to modify access right of %s; error = 0x%.8x;[3]
Failed to modify access right of %s
%s\*.*
Failed to modify access right of %s; error = 0x%.8x;[2]
Failed to modify access right of %s; error = 0x%.8x;[1]
The last update not success.
UPDATE
Version
rsupdate.xml
%s\rsupdate.xml
RsUpdate.xml
Download %s retry > 3
%s/%s%s.inf
%s%s/%s%s.inf
CompsVer
Failed to copy "%s" to "%s".
CompsVer.inf
Failed to find \ in %s.
Failed to CreateProcess(%s);LastError=%d
"%sProgram Files\Internet Explorer\iexplore.exe" %s
"%s\Internet Explorer\iexplore.exe" %s
Failed to Get CSIDL_PROGRAM_FILES.
Failed to get windows dir.
OpenURL("%s")
"%s\RegGuide.exe" /smartup %s
Launch RegGuide' param is %s.
UnPatch %s fail
\Temp
The MD5 value of Patch File %s isn't valid.
CHECK
RsUnCompressFile %s fail
RsCombinePatchFile %s Fail
%s\%s\%s%d
%s%s/%s/%s/%s%d
%s/%s/%s/%s%d
FilesCount
ZipName
Smart download size = %d; increase download size = %d
PATCHINFO
PatchSize
%s/%s/%s
%s\%s\%s
%s%s/%s/%s/%s
PatchInfo.ini
least
%s/%s/%s.inf
%s%s/%s/%s.inf
%s\%s.inf
IncUpdate Component: Name = %s; oldver = %s; newver = %s
Failed to copy from %s to %s, Please try again later.
\PreUpdate
FileName
FILES
%s\Upgrade.xml
PrePare
%s\xmls\%s.xml
%s\%s\%s.xml
%s\Download
Failed to load %s
%s\%s\update.xml
rssetup
%s\update.xml
%s\BackUp\%s
the run path-%s not correct
/LANG=
/LANG
/PRODUCT=
"%s\%s" /UPDATE
Setup.exe
Load "%s" Fail!
Failed to get %s-COMPONENT.
%s/%s/%s_xml.zip
%s%s/%s/%s.xml
COMPONENT
%s\%s.xml
23.00
\Update.Log
Failed to get update xml url.
Component
Subkey
%s%s/%s/%s
%s\%s\PreUpdate\%s\%s
%s\Backup\%s\%s
subkey
Update Component: Name = %s; oldver = %s; newver = %s
RPSIZE
Failed copy "%s" to "%s"!
FILENAME
SOURCEPATH
Failed to get %s-ITEM.
Failed to get %s-FILES.
Prepare
new component %s not need download
MUSTINSTALL
Failed to load %s!
%s.xml
The component %s had updated at last update.
Successed to rsd send finish .
Send rsd Finish over 3 time.
Failed to send rsd finish, hr = %x, Error = %d.
tag=RSD&sn=&id=&over=%s&nver=%s&host=%s&actionid=&state=&sn_privilege=&sn_proname=&sn_protype=&sn_area=&sn_clientnum=&sn_limit=
timeInterval
Successed to send finish .
Send Finish over 3 time.
Failed to send finish, hr = %x, Error = %d.
/RsMgrsvc
/subkey
finish
download
Failed to get child urllist from %s
Failed to get child product from %s
\popwndexe.exe
SoftWare\Microsoft\Windows\Currentversion\Run
%s\RsMgrsvc.ini
REGKEYVALUE
REGKEYNAME
MICROSOFT\WINDOWS\CURRENTVERSION\RUN
REGKEY
Failed to get REGISTS-ITEM from %s
Failed to get REGISTS from %s
REGISTS
/update
DEPEND
LOADORDERGROUP
ERRCONTROL
STARTTYPE
DISPNAME
SYSTEM\CurrentControlSet\services
Failed to get SERVICE-ITEM from %s
Failed to get SERVICE from %s
SERVICE
MoveFile From %s To %s
/exit
Failed to get FILENAME from %s
FAILED to copy %s to %s
Succeed to copy %s to %s
%s\%s\%s\%s
WIN64
RUNOS
Failed to get FILES-ITEM from %s
Failed to get FILES from %s
Failed to get COMPONENT from %s
IsWow64Process
Failed to get download URL:internal server error
interval=%s
interval
warning
Failed to find Param from %s
sinfo
ValidateInfo
Get download URL retry > 3
Failed to get downloadurl: ErrCode = 0x%x; LastError = %d
%s/%s/setup_xml.zip
\Setup.xml
Setup.xml
%s\%s\setup.xml
%s need update
Failed to copy "%s" to "%s"
Failed to Find _XXX component.
%s\xmls\rssetup.xml
/SUBKEY
"%s\backup\%s\%s\%s" /UPDATE
Updater.exe
/UC
/RsMgrSvc
/RsMgrSvc
/LANG
/TRAY
/SILENCE
/SUBKEY
"%s\updater.exe" /UPDATED
Failed to get update component name.
Failed to get install component name.
Failed to get all component name.
Update from %s to %s
product cancel update.
The Rising software installed on your computer is the latest version.
bad cast
</%s>
<!--%s-->
standalone="%s"
encoding="%s"
version="%s"
<?xml
&#x%02X;
%s='%s'
%s="%s"
<![CDATA[
false
standalone="
encoding="
version="
raB3Ge
Error parsing CDATA.
Error null (0) or unexpected EOF found in input stream.
Error document empty.
Error parsing Declaration.
Error parsing Comment.
Error parsing Unknown.
Error reading end tag.
Error: empty tag.
Error reading Attributes.
Error reading Element value.
Failed to read Element name
Error parsing Element.
Memory allocation failed.
Failed to open file
No error
'
"
&
<?xml
standalone
encoding
version
UTF-8
VDEST
invalid string position
string too long
ios_base::eofbit set
ios_base::failbit set
ios_base::badbit set
bad allocation
Unknown exception
LC_TIME
LC_NUMERIC
LC_MONETARY
LC_CTYPE
LC_COLLATE
LC_ALL
Microsoft Visual C++ Runtime Library
Program:
<program name unknown>
Buffer overrun detected!
Unknown security failure detected!
CorExitProcess
mscoree.dll
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
`h````
(null)
e+000
GAIsProcessorFeaturePresent
KERNEL32
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
runtime error
Program:
InitializeCriticalSectionAndSpinCount
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
am/pm
Paraguay
Uruguay
Chile
Ecuador
Argentina
Colombia
Venezuela
Dominican Republic
South Africa
Panama
Luxembourg
Costa Rica
Switzerland
Guatemala
Canada
Spanish - Modern Sort
Australia
English
Austria
German
Belgium
Mexico
Spanish
Basque
Sweden
Swedish
Iceland
Icelandic
France
French
Finland
Finnish
Spain
Spanish - Traditional Sort
united-states
united-kingdom
trinidad & tobago
south-korea
south-africa
south korea
south africa
slovak
puerto-rico
pr-china
pr china
new-zealand
hong-kong
holland
great britain
england
czech
china
britain
america
swiss
swedish-finland
spanish-venezuela
spanish-uruguay
spanish-puerto rico
spanish-peru
spanish-paraguay
spanish-panama
spanish-nicaragua
spanish-modern
spanish-mexican
spanish-honduras
spanish-guatemala
spanish-el salvador
spanish-ecuador
spanish-dominican republic
spanish-costa rica
spanish-colombia
spanish-chile
spanish-bolivia
spanish-argentina
portuguese-brazilian
norwegian-nynorsk
norwegian-bokmal
norwegian
italian-swiss
irish-english
german-swiss
german-luxembourg
german-lichtenstein
german-austrian
french-swiss
french-luxembourg
french-canadian
french-belgian
english-usa
english-us
english-uk
english-trinidad y tobago
english-south africa
english-nz
english-jamaica
english-ire
english-caribbean
english-can
english-belize
english-aus
english-american
dutch-belgian
chinese-traditional
chinese-singapore
chinese-simplified
chinese-hongkong
chinese
canadian
belgian
australian
american-english
american english
american
Norwegian-Nynorsk
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
1#QNAN
1#INF
1#IND
1#SNAN
the max length & max offset is limited by the sizeof the storing bits.
the max length is limited by the sizeof the storing bits.
<!--%s-->
.rstmp
failure to read input stream
1.1.3
Rav.tst
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
HWvAMfucZl015oANxGiVHlPcFL4ILURH6WNhxqN9pvcB9VkSfbUz2P0nL2v0J+j1s4rF726edB2G8Y+b7QVqMPG
CQ5ZWQt10JfpPu+osOZbRH2d6I1EGK/jI7uAAzWQqqzkg5BNdVlvrae/Xt19wB/gDupIBF1XMf2c/b+VZ72vRrc
V//////////////////////////////////////////+b66XuE/BvPhVym1IFS9fT0xjScuYPn7hhjljnwHE6G9
56LFhbXZXoQ7vAQ8Q2sXK3kejfoMvcp5VEuj8cHZl49uLOPEL7iVfDx5bB0lJknlmSrSz+8FImqyUz57zHhK3y0
V//////////////////////////////////////////////////////////////////////////////////////
ECC-521
DXVUIfOcB6zTdfY/afBSAVZq7RqecXHywTen4xNmkC0AOB7E7Nw1dNf37NoGwWvV
geVA8hwB1JUEiSSUyo2jT6uTEsABfvkOMVT1u89KAZXL0l9TlrKfR3fKNZXoTWgt
////////////////////////////////nsDDWVGtBTzO6WsoIB2dUkpi6MhCnIbp
ip4lf+8+v+IOZWLhu/Wj6HWTd6x+WK4I0nG8Zr0JXrh6LZcDYYxHdIg5oEtJx2hl
//////////////////////////////////////////x/////00000000003/////
ECC-384
4/ZGkB+6d+RZkVhIdmFdXOhpZDNQp5UpiksG6Wtlr7r
6iNqVBXB497+BpcvMEaGF9t0ts1BUipeFIXEKNOcCAM
F////y00000//////////+yvlgjfnUUXFEvoiByOoLH
5h6DTYgEfFdi+kzLNQOXhnb7GQmp5EmzZlEF3udqc1B
F////y000010000000000000000////////////////
ECC-256
2zDsE8jVSZ+qmYt+RDGtMWMWT7P4JLWPc507uq
2t3WozQxI/Vp8JaBbA0y7JLi8H8ZGoWDOHN1qX
3//////////////////nQYuBZmFXFTAKLSN2ez
2q1Gg530Ipg/L1CbPGHB2trx/OkYSBEKCZLV+q
3/////////////////////0000000000000001
ECC-224
1nahbV/8sdXZ417jQoJDrNFvTw4UUKWH
68se3h0maFPylo3hGw680FJ/2ls2/n0I
////////////////cTxuDXHhoR6qqYWn
P2456UMSWESFf+chSYGmIVwutkp1Hhcn
/////////////////////l//////////
ECC-192
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/
Value out of range
Out of heap
Successful
Invalid error code
0123456789
C:\DistributedAutoLink\Temp\CompileOutputDir\Updater.pdb
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
HeapFree
GetProcessHeap
lstrlenA
FreeLibrary
lstrcpyA
GlobalFree
GlobalAlloc
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
DeviceIoControl
CloseHandle
CreateFileA
GetModuleFileNameA
GetModuleHandleA
GetLastError
CreateDirectoryA
lstrcpynA
SetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
MoveFileA
lstrcmpiA
FlushFileBuffers
WriteFile
SetEndOfFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
DeleteFileA
SetFileAttributesA
FileTimeToSystemTime
FindClose
FindFirstFileA
GetLocalTime
lstrcatA
GetTempPathA
GetPrivateProfileIntA
GetDriveTypeA
WritePrivateProfileStringA
GetLogicalDriveStringsA
GetSystemDirectoryA
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetPrivateProfileStringA
GetFileSize
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringA
GetTickCount
IsBadReadPtr
MultiByteToWideChar
Sleep
ReadFile
GetVersion
lstrlenW
lstrcmpiW
CompareStringA
CompareStringW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetStringTypeExA
GetStringTypeExW
GlobalUnlock
GlobalLock
InterlockedIncrement
InterlockedDecrement
MulDiv
LoadLibraryExA
IsDBCSLeadByte
GetCommandLineA
ReleaseMutex
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateMutexA
RemoveDirectoryA
FindNextFileA
GetFileAttributesA
GetDiskFreeSpaceA
CopyFileA
GetExitCodeThread
SuspendThread
ResumeThread
TerminateThread
OpenProcess
CreateProcessA
ProcessIdToSessionId
GetPrivateProfileSectionA
KERNEL32.dll
EndDialog
SetWindowPos
SetDlgItemTextA
GetDlgItem
SetFocus
MessageBeep
UnregisterClassA
SetWindowLongA
GetWindowTextA
GetWindowTextLengthA
RegisterWindowMessageA
wsprintfA
IsWindow
SendMessageA
DestroyWindow
GetWindowLongA
SetWindowTextA
GetWindowRect
ShowWindow
IsWindowEnabled
EnableWindow
GetLastActivePopup
MessageBoxA
IsDialogMessageA
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindow
GetParent
CharUpperA
FindWindowA
wvsprintfA
DestroyIcon
LoadIconA
PostQuitMessage
PtInRect
GetCursorPos
DialogBoxParamA
SetForegroundWindow
LoadImageA
GetSystemMetrics
GetActiveWindow
CharLowerA
CharLowerW
CharUpperW
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
ReleaseDC
GetDC
CreateDialogIndirectParamA
DefWindowProcA
CharNextA
GetDlgCtrlID
GetClassNameA
KillTimer
PostMessageA
USER32.dll
GetDeviceCaps
GetObjectA
GetStockObject
GDI32.dll
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueA
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryInfoKeyA
RegEnumKeyExA
IsValidSid
CopySid
GetLengthSid
AddAce
InitializeAcl
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
CreateProcessAsUserA
CloseServiceHandle
StartServiceA
QueryServiceStatus
CreateServiceA
OpenServiceA
OpenSCManagerA
ADVAPI32.dll
Shell_NotifyIconA
SHELL32.dll
PropVariantClear
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
ole32.dll
OLEAUT32.dll
PathSkipRootA
PathRemoveFileSpecA
PathFileExistsA
SHStrDupW
SHLWAPI.dll
InitCommonControlsEx
COMCTL32.dll
InternetCloseHandle
InternetAttemptConnect
InternetConnectA
InternetOpenA
InternetSetOptionA
InternetCrackUrlA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
WININET.dll
WSOCK32.dll
UuidCreate
RPCRT4.dll
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VERSION.dll
HeapDestroy
HeapReAlloc
HeapSize
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
FatalAppExitA
QueryPerformanceCounter
SetUnhandledExceptionFilter
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
TlsAlloc
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
GetOEMCP
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadCodePtr
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
LocalFree
lstrcmpA
GetTempFileNameA
.?AVCAtlException@ATL@@
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
.?AVexception@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
welcome Rising*youarelawless!y2a3n4g5Y6U7q8i@S9I0N#A.C%O(M-)<>ABI993JIEM,;'{jkliewaqlsiqomv.z^iwaql}-_=+)_(l;2j2f90aslkjflkasjas32092JKLSJFbASAUI/Z/A[/,./|@~`FS'.Z,MF920SDLAFJKAL9320QFFMmlajfl,.<>//|348q9729|fjlail3jo798,ksafa302-s;akfa;=_++-0-_))0-0-p23is
welcome Rising*youarelawless!y2a$n4g5Y6U7q8i@S9I0N#A.C%O(M-)<>ABI99*JIEM,;'{jkliewaqlsiqomv.z^iwaql}-_=+)_(l;2j@f90aslkjflkasjas6j09kJKLSJFbASAUI/Z/A[/,./|@~`FS'.Z,MF920SDLAFJKAL9320QFFMmlajfl,.<>//|348q9729|fjlail3jo798,ksafa302-s;akfa;=_++-0-_))0-0-p^bis
.?AVbad_cast@@
.?AVfacet@locale@std@@
.?AV_Locimp@locale@std@@
.?AV?$_Iosb@H@std@@
.?AVios_base@std@@
.?AVruntime_error@std@@
.?AVfailure@ios_base@std@@
.?AVbad_alloc@std@@
Copyright (c) 1992-2001 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
.?AVtype_info@@
.?AVbad_typeid@@
.?AV__non_rtti_object@@
.?AV_com_error@@
.?AVfileio_fails@@
1.1.3
need dictionary
incorrect data check
incorrect header check
invalid window size
unknown compression method
incompatible version
buffer error
insufficient memory
data error
stream error
file error
stream end
invalid bit length repeat
too many length or distance symbols
invalid stored block lengths
invalid block type
invalid distance code
invalid literal/length code
incomplete dynamic bit lengths tree
oversubscribed dynamic bit lengths tree
incomplete literal/length tree
oversubscribed literal/length tree
empty distance tree with lengths
incomplete distance tree
oversubscribed distance tree
EWTXXXXs
XTWXXYtYw=
n4-++-5f
*9LWM7
*HS_a!
RXejl^5
"Xekl_7'
"N65 I
%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X
APPID
REGISTRY
Module_Raw
Module
unknown
Select * from
root\cimv2
(null)
Updater
MS Sans Serif
&Stop
Current progress:
Total progress:
Hide update window
msctls_progress32
msctls_progress32
In the process of dial-up
MS Shell Dlg
Hang-up(&H)
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Beijing Rising Information Technology Co., Ltd.
FileDescription
Updater Application
FileVersion
1.0.0.43
InternalName
Beijing Rising Information Technology Co., Ltd.
LegalCopyright
Copyright(C) 2011-2012 Beijing Rising Information Technology Co., Ltd. All Rights Reserved.
OriginalFilename
Updater.exe
ProductName
Rising Software Distribute System
ProductVersion
SpecialBuild
896289451093750
VarFileInfo
Translation
Updater
SmartUpdate
Get the last version
| 防病毒引擎/厂商 | 病毒名/规则匹配 | 病毒库日期 |
|---|---|---|
| Bkav | 未发现病毒 | 20160827 |
| MicroWorld-eScan | 未发现病毒 | 20160827 |
| nProtect | 未发现病毒 | 20160827 |
| CMC | 未发现病毒 | 20160824 |
| CAT-QuickHeal | 未发现病毒 | 20160826 |
| ALYac | 未发现病毒 | 20160827 |
| Malwarebytes | 未发现病毒 | 20160827 |
| Zillya | 未发现病毒 | 20160826 |
| TheHacker | 未发现病毒 | 20160826 |
| BitDefender | 未发现病毒 | 20160827 |
| K7GW | 未发现病毒 | 20160827 |
| K7AntiVirus | 未发现病毒 | 20160827 |
| TrendMicro | 未发现病毒 | 20160827 |
| Baidu | 未发现病毒 | 20160827 |
| F-Prot | 未发现病毒 | 20160827 |
| Symantec | 未发现病毒 | 20160827 |
| TotalDefense | 未发现病毒 | 20160827 |
| TrendMicro-HouseCall | 未发现病毒 | 20160827 |
| Avast | 未发现病毒 | 20160827 |
| ClamAV | Win.Worm.Chir-2647 | 20160827 |
| Kaspersky | 未发现病毒 | 20160827 |
| Alibaba | 未发现病毒 | 20160826 |
| NANO-Antivirus | 未发现病毒 | 20160827 |
| ViRobot | 未发现病毒 | 20160827 |
| AegisLab | 未发现病毒 | 20160827 |
| Tencent | 未发现病毒 | 20160827 |
| Ad-Aware | 未发现病毒 | 20160827 |
| Sophos | 未发现病毒 | 20160827 |
| Comodo | 未发现病毒 | 20160827 |
| F-Secure | 未发现病毒 | 20160827 |
| DrWeb | 未发现病毒 | 20160827 |
| VIPRE | 未发现病毒 | 20160827 |
| Invincea | 未发现病毒 | 20160826 |
| McAfee-GW-Edition | 未发现病毒 | 20160827 |
| Emsisoft | 未发现病毒 | 20160827 |
| Cyren | 未发现病毒 | 20160827 |
| Jiangmin | 未发现病毒 | 20160827 |
| Avira | 未发现病毒 | 20160827 |
| Antiy-AVL | 未发现病毒 | 20160827 |
| Kingsoft | 未发现病毒 | 20160827 |
| Microsoft | 未发现病毒 | 20160827 |
| Arcabit | 未发现病毒 | 20160827 |
| SUPERAntiSpyware | 未发现病毒 | 20160826 |
| GData | 未发现病毒 | 20160827 |
| AhnLab-V3 | 未发现病毒 | 20160826 |
| McAfee | 未发现病毒 | 20160827 |
| AVware | 未发现病毒 | 20160827 |
| VBA32 | 未发现病毒 | 20160826 |
| Zoner | 未发现病毒 | 20160827 |
| ESET-NOD32 | 未发现病毒 | 20160827 |
| Rising | 未发现病毒 | 20160827 |
| Yandex | 未发现病毒 | 20160826 |
| Ikarus | 未发现病毒 | 20160827 |
| Fortinet | 未发现病毒 | 20160827 |
| AVG | 未发现病毒 | 20160827 |
| Panda | 未发现病毒 | 20160827 |
| CrowdStrike | 未发现病毒 | 20160826 |
| Qihoo-360 | 未发现病毒 | 20160827 |
访问主机纪录 (可点击查询WPING实时安全评级)
| 直接 | IP | 安全评级 | 地理位置 |
|---|---|---|---|
| 否 | 93.46.8.89 | 意大利 | |
| 否 | 58.211.137.192 | 中国 | |
| 否 | 23.44.155.27 | 美国 | |
| 否 | 198.41.215.182 | 美国 | |
| 否 | 122.224.10.248 | 中国 | |
| 否 | 117.18.237.29 | 亚洲太平洋地区 |
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.70 | 51098 | 117.18.237.29 ocsp.digicert.com | 80 |
| 192.168.122.70 | 51080 | 122.224.10.248 www.download.windowsupdate.com | 80 |
| 192.168.122.70 | 51093 | 178.255.83.1 | 80 |
| 192.168.122.70 | 51079 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51099 | 198.41.215.182 ocsp.msocsp.com | 80 |
| 192.168.122.70 | 51081 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51089 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51092 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51100 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51102 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51103 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51090 | 58.211.137.192 ocsp2.globalsign.com | 80 |
| 192.168.122.70 | 51097 | 58.211.137.192 ocsp2.globalsign.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.70 | 49587 | 192.168.122.1 | 53 |
| 192.168.122.70 | 49765 | 192.168.122.1 | 53 |
| 192.168.122.70 | 50445 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51346 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51435 | 192.168.122.1 | 53 |
| 192.168.122.70 | 53017 | 192.168.122.1 | 53 |
| 192.168.122.70 | 53817 | 192.168.122.1 | 53 |
| 192.168.122.70 | 55583 | 192.168.122.1 | 53 |
| 192.168.122.70 | 55849 | 192.168.122.1 | 53 |
| 192.168.122.70 | 56856 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59175 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59400 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59485 | 192.168.122.1 | 53 |
| 192.168.122.70 | 60193 | 192.168.122.1 | 53 |
| 192.168.122.70 | 60311 | 192.168.122.1 | 53 |
| 192.168.122.70 | 61230 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65053 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65064 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65276 | 192.168.122.1 | 53 |
| 192.168.122.70 | 5355 | 192.168.122.69 | 53197 |
| 192.168.122.70 | 5355 | 192.168.122.69 | 64810 |
域名解析 (可点击查询WPING实时安全评级)
TCP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.70 | 51098 | 117.18.237.29 ocsp.digicert.com | 80 |
| 192.168.122.70 | 51080 | 122.224.10.248 www.download.windowsupdate.com | 80 |
| 192.168.122.70 | 51093 | 178.255.83.1 | 80 |
| 192.168.122.70 | 51079 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51099 | 198.41.215.182 ocsp.msocsp.com | 80 |
| 192.168.122.70 | 51081 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51089 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51092 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51100 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51102 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51103 | 23.44.155.27 ocsp.verisign.com | 80 |
| 192.168.122.70 | 51090 | 58.211.137.192 ocsp2.globalsign.com | 80 |
| 192.168.122.70 | 51097 | 58.211.137.192 ocsp2.globalsign.com | 80 |
UDP
| 源地址 | 源端口 | 目标地址 | 目标端口 |
|---|---|---|---|
| 192.168.122.70 | 49587 | 192.168.122.1 | 53 |
| 192.168.122.70 | 49765 | 192.168.122.1 | 53 |
| 192.168.122.70 | 50445 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51346 | 192.168.122.1 | 53 |
| 192.168.122.70 | 51435 | 192.168.122.1 | 53 |
| 192.168.122.70 | 53017 | 192.168.122.1 | 53 |
| 192.168.122.70 | 53817 | 192.168.122.1 | 53 |
| 192.168.122.70 | 55583 | 192.168.122.1 | 53 |
| 192.168.122.70 | 55849 | 192.168.122.1 | 53 |
| 192.168.122.70 | 56856 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59175 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59400 | 192.168.122.1 | 53 |
| 192.168.122.70 | 59485 | 192.168.122.1 | 53 |
| 192.168.122.70 | 60193 | 192.168.122.1 | 53 |
| 192.168.122.70 | 60311 | 192.168.122.1 | 53 |
| 192.168.122.70 | 61230 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65053 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65064 | 192.168.122.1 | 53 |
| 192.168.122.70 | 65276 | 192.168.122.1 | 53 |
| 192.168.122.70 | 5355 | 192.168.122.69 | 53197 |
| 192.168.122.70 | 5355 | 192.168.122.69 | 64810 |
HTTP 请求
| URI | HTTP数据 |
|---|---|
| URL专业沙箱检测 -> http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 86402 Connection: Keep-Alive Accept: */* If-Modified-Since: Thu, 14 Jan 2016 00:22:10 GMT If-None-Match: "0e59c9b614ed11:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
| URL专业沙箱检测 -> http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.verisign.com |
| URL专业沙箱检测 -> http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CEEEAJreuKZY7YI1hkRt3HhY%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CEEEAJreuKZY7YI1hkRt3HhY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.verisign.com |
| URL专业沙箱检测 -> http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CEEEAJreuKZY7YI1hkRt3HhY%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CEEEAJreuKZY7YI1hkRt3HhY%3D HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.verisign.com |
| URL专业沙箱检测 -> http://ss.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEFYLnHjjHwADjD39iRSceNk%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEFYLnHjjHwADjD39iRSceNk%3D HTTP/1.1 Cache-Control: max-age = 471898 Connection: Keep-Alive Accept: */* If-Modified-Since: Fri, 22 Jan 2016 20:24:23 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ss.symcd.com |
| URL专业沙箱检测 -> http://ocsp2.globalsign.com/gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV%2FtqUV3SNMRE%2Bs25eR%2FvhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhyNkSBZL0u2zY4jc9udsWFw%3D%3D | GET /gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV%2FtqUV3SNMRE%2Bs25eR%2FvhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhyNkSBZL0u2zY4jc9udsWFw%3D%3D HTTP/1.1 Cache-Control: max-age = 180 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 24 Jan 2016 08:12:59 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp2.globalsign.com |
| URL专业沙箱检测 -> http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEFV%2F%2FzzjA%2F6oY6Vtno9bzTU%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEFV%2F%2FzzjA%2F6oY6Vtno9bzTU%3D HTTP/1.1 Cache-Control: max-age = 381196 Connection: Keep-Alive Accept: */* If-Modified-Since: Thu, 21 Jan 2016 16:19:41 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: tl.symcd.com |
| URL专业沙箱检测 -> http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1 Cache-Control: max-age = 311241 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 23 Jan 2016 23:57:39 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.usertrust.com |
| URL专业沙箱检测 -> http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH | GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH HTTP/1.1 Cache-Control: max-age = 10800 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 24 Jan 2016 05:50:23 GMT If-None-Match: "611749fc10ad79b9b9cd23c4bf787c5ae78576ef" User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.globalsign.com |
| URL专业沙箱检测 -> http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Cache-Control: max-age = 500863 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 23 Jan 2016 22:46:14 GMT If-None-Match: "56a402b6-1d7" User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com |
| URL专业沙箱检测 -> http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAN43VPPQBXGCMiwAAQAA3jc%3D | GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAN43VPPQBXGCMiwAAQAA3jc%3D HTTP/1.1 Cache-Control: max-age = 10800 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 24 Jan 2016 06:30:15 GMT If-None-Match: "77a3ed05d7337d023a726d1efae9caf1857cedc9" User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.msocsp.com |
| URL专业沙箱检测 -> http://ss.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEC7Ss3YcBffkpx9UsN1ZWpU%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV%2Bc%2FAZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEC7Ss3YcBffkpx9UsN1ZWpU%3D HTTP/1.1 Cache-Control: max-age = 535551 Connection: Keep-Alive Accept: */* If-Modified-Since: Sat, 23 Jan 2016 14:04:33 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ss.symcd.com |
| URL专业沙箱检测 -> http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBkaMst1nJe4z6wRjdUSf0k%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBkaMst1nJe4z6wRjdUSf0k%3D HTTP/1.1 Cache-Control: max-age = 584283 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 24 Jan 2016 03:35:04 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: s.symcd.com |
| URL专业沙箱检测 -> http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEDWXMYfzhzoHMn7OWAybfto%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEDWXMYfzhzoHMn7OWAybfto%3D HTTP/1.1 Cache-Control: max-age = 361610 Connection: Keep-Alive Accept: */* If-Modified-Since: Thu, 21 Jan 2016 13:39:51 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.verisign.com |
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
| 文件名 | updater.exe.log |
|---|---|
| 相关文件 |
C:\Users\test\AppData\Local\Temp\updater.exe.log
|
| 文件大小 | 234 字节 |
| 文件类型 | ASCII text, with CRLF line terminators |
| MD5 | 77cbc9de22b7c37fcf59b9634198ef72 |
| SHA1 | 3d5e8f850ba2289bb4d51721db16bd62da4942bd |
| SHA256 | 4303f5bc20ae5d31c1726eb50309e9a338332243614b152ee4317d2ce407489d |
| CRC32 | 8C397042 |
| Ssdeep | 6:oLyhNdJBIm+kn23fPXv42kB4wz1Pm+kn23fLX47Jy:oLyjdJBk3w2AHDINy |
| 下载 提交魔盾安全分析 显示文本 | |
[2016-05-21][14:00:22:721][2776][1248]: [DETAIL]CommdLine: "C:\Users\test\AppData\Local\Temp\updater.exe" [2016-05-21][14:00:22:768][2776][2124]: [ALERT]Failed to load C:\Users\test\AppData\Local\Temp\BackUp\rsd\rssetup\update.xml |
|
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 33.933 seconds )
- 29.975 NetworkAnalysis
- 1.087 VirusTotal
- 1.023 Static
- 0.605 BehaviorAnalysis
- 0.457 peid
- 0.348 Dropped
- 0.256 TargetInfo
- 0.079 Strings
- 0.068 Debug
- 0.022 AnalysisInfo
- 0.01 config_decoder
- 0.002 Memory
- 0.001 ProcessMemory
Signatures ( 0.208 seconds )
- 0.039 antiav_detectreg
- 0.023 stealth_timeout
- 0.015 infostealer_ftp
- 0.01 antivm_generic_scsi
- 0.01 infostealer_im
- 0.008 antianalysis_detectreg
- 0.008 md_domain_bl
- 0.007 bootkit
- 0.007 infostealer_mail
- 0.006 antiav_detectfile
- 0.006 geodo_banking_trojan
- 0.006 ransomware_files
- 0.005 mimics_filetime
- 0.005 stealth_file
- 0.005 persistence_autorun
- 0.004 reads_self
- 0.004 virus
- 0.004 infostealer_bitcoin
- 0.003 antivm_vbox_files
- 0.003 network_torgateway
- 0.002 tinba_behavior
- 0.002 antivm_generic_services
- 0.002 betabot_behavior
- 0.002 kibex_behavior
- 0.002 antivm_generic_disk
- 0.002 disables_browser_warn
- 0.002 network_http
- 0.001 antiemu_wine_func
- 0.001 antivm_vbox_libs
- 0.001 shifu_behavior
- 0.001 vawtrak_behavior
- 0.001 antidbg_devices
- 0.001 antivm_generic_diskreg
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 modify_proxy
- 0.001 browser_security
- 0.001 darkcomet_regkeys
- 0.001 md_url_bl
- 0.001 modify_uac_prompt
- 0.001 network_cnc_http
- 0.001 recon_fingerprint
Reporting ( 1.877 seconds )
- 1.267 ReportPDF
- 0.598 ReportHTMLSummary
- 0.012 Malheur
| Task ID | 18271 |
|---|---|
| Mongo ID | 57ddec4d4d3bd03918149bbc |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号