|
|

楼主 |
发表于 2022-5-15 19:08
|
显示全部楼层
行为描述: 设置消息钩子
详情信息:
C:\Documents and Settings\Administrator\Local Settings\%temp%\._cache_%temp%\****.exe
C:\WINDOWS\system32\Synaptics\Synaptics.dll
行为描述: 获取TickCount值
详情信息:
TickCount = 223312, SleepMilliseconds = 1000.
TickCount = 223546, SleepMilliseconds = 1000.
TickCount = 223609, SleepMilliseconds = 1000.
TickCount = 223625, SleepMilliseconds = 1000.
行为描述: 设置特殊文件属性
详情信息:
C:\Documents and Settings\Administrator\Local Settings\%temp%\._cache_%temp%\****.exe
C:\WINDOWS\system32\Synaptics\Synaptics.exe
C:\WINDOWS\system32\Synaptics\Synaptics.dll
行为描述: 查找PE资源信息
详情信息:
(FindResourceA) hModule = 0x00400000, ResName: EXERESX, ResType:
(FindResourceA) hModule = 0x00400000, ResName: KBHKS, ResType:
行为描述: 获取窗口截图信息
详情信息:
Foreground window Info: HWND = 0x00010014, DC = 0x0a010375.
行为描述: 设置特殊文件夹属性
详情信息:
C:\WINDOWS\system32\Synaptics
C:\Documents and Settings\Administrator\Application Data\WinSl
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\Administrator\IECompatCache
行为描述: 修改注册表_启动项
详情信息:
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver |
|