|
|
行为描述: 直接调用系统关键API
详情信息:
Index = 0x0000009A, Name: NtQueryInformationProcess, Instruction Address = 0x02171235
Index = 0x000000E5, Name: NtSetInformationThread, Instruction Address = 0x02171235
Index = 0x0000007D, Name: NtOpenSection, Instruction Address = 0x02171235
Index = 0x00000019, Name: NtClose, Instruction Address = 0x02FCF78C
行为描述: VMWare特殊指令检测虚拟机
详情信息:
N/A |
|