哈勃链接：https://habo.qq.com/file/showdetail?pk=ADwGZl1vB2YIMVs4#net申请官方审核
| 行为描述： | 下载文件 | | 详情信息： | URLDownloadToFileW: http://ww****om/favicon.ico ---> C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | | 行为描述： | 连接指定站点 | | 详情信息： | InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000 InternetConnectA: ServerName = ur****om, PORT = 443, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000200 | | 行为描述： | 打开HTTP连接 | | 详情信息： | InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004 InternetOpenA: UserAgent: VCSoapClient, hSession = 0x00cc0010 | | 行为描述： | 建立到一个指定的套接字连接 | | 详情信息： | URL: su****om, IP: **.133.40.**:447, SOCKET = 0x000000bc URL: go****om, IP: **.133.40.**:80, SOCKET = 0x000000c8 URL: tv****om, IP: **.133.40.**:447, SOCKET = 0x0000010c URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x00000464 URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x000005b0 URL: rt****om, IP: **.133.40.**:447, SOCKET = 0x00000108 URL: ur****om, IP: **.133.40.**:443, SOCKET = 0x0000059c URL: wq****om, IP: **.133.40.**:447, SOCKET = 0x00000114 | | 行为描述： | 读取网络文件 | | 详情信息： | hFile = 0x00cc000c, BytesToRead =2048, BytesRead = 2048. hFile = 0x00cc0018, BytesToRead =4095, BytesRead = 4095. | | 行为描述： | 发送HTTP包 | | 详情信息： | GET / HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Accept-Encoding: gzip, deflate Host: ww****om Connection: Keep-Alive GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive | | 行为描述： | 打开HTTP请求 | | 详情信息： | HttpOpenRequestA: ww****om:80/, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400200 HttpOpenRequestA: ww****om:80/favicon.ico, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00600010 HttpOpenRequestA: ur****om:443/urs.asmx?msurs-client-key=lvbezmwh8n6h9%2bxc6qzoja%3d%3d&msurs-patented-lock=ijcifk8eoha%3d, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: POST, Referer: , Flags = 0x04880300 | | 行为描述： | 按名称获取主机地址 | | 详情信息： | gethostbyname: su****om gethostbyname: go****om GetAddrInfoW: ww****om gethostbyname: tv****om gethostbyname: rt****om GetAddrInfoW: ur****om gethostbyname: wq****om |
| 文件名称： | csrss.exe | | MD5： | 97ac1687c038394b09f2a6c4877c3ba0 | | 文件类型： | EXE | | 上传时间： | 2018-08-22 10:31:58 | | 出品公司： | 煜风 | | 版本： | 1.0.0.0---1.0.0.0 | | 壳或编译器信息： | COMPILER:Elan |
|
[复制链接]
雷达卡
发表于 2018-8-22 10:32
显身卡