VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

VirSCAN
VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

File information

Scanner results
Scanner results:0%Scanner(s) (0/39)found malware!
Behavior analysis report:         Habo file analysis
Time: 2014-11-13 18:28:16 (CST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
ahnlab 9.9.9 9.9.9 2013-05-28 Found nothing 3
antivir 1.9.2.0 1.9.159.0 7.11.184.224 Found nothing 12
antiy 114701 AVL141003 2014-10-04 Found nothing 7
arcavir 1.0 2011 2014-05-30 Found nothing 9
asquared 9.0.0.4157 9.0.0.4157 2014-07-30 Found nothing 4
avast 141112-0 4.7.4 2014-11-12 Found nothing 2
avg 2109/8019 10.0.1405 2014-11-06 Found nothing 10
baidu 2.0.1.0 4.1.3.52192 2.0.1.0 Found nothing 3
baidusd 1.0 1.0 2014-04-02 Found nothing 3
bitdefender 7.57701 7.90123 2014-11-13 Found nothing 9
clamav 19613 0.97.5 2014-11-11 Found nothing 6
comodo 15023 5.1 2014-10-03 Found nothing 3
ctch 4.6.5 5.3.14 2013-12-01 Found nothing 1
drweb 5.0.2.3300 5.0.1.1 2014-10-31 Found nothing 58
fortinet 23.171, 23.171 5.1.158 2014-11-13 Found nothing 2
fprot 4.6.2.117 6.5.1.5418 2014-11-11 Found nothing 2
fsecure 2014-04-02-01 9.13 2014-04-02 Found nothing 15
gdata 24.3819 24.3819 2014-08-29 Found nothing 12
hauri 2.73 2.73 2014-06-13 Found nothing 1
ikarus 1.06.01 V1.32.31.0 2014-11-12 Found nothing 21
jiangmin 16.0.100 1.0.0.0 2014-07-28 Found nothing 14
kaspersky 5.5.33 5.5.33 2014-04-01 Found nothing 28
kingsoft 2.1 2.1 2013-09-22 Found nothing 3
mcafee 7520 5400.1158 2014-08-04 Found nothing 11
nod32 0436 3.0.21 2014-09-18 Found nothing 3
panda 9.05.01 9.05.01 2014-06-15 Found nothing 4
pcc 11.272.05 9.500-1005 2014-11-12 Found nothing 3
qh360 1.0.1 1.0.1 1.0.1 Found nothing 12
qqphone 1.0.0.0 1.0.0.0 2014-11-13 Found nothing 1
quickheal 14.00 14.00 2014-06-14 Found nothing 8
rising 25.17.00.04 25.17.00.04 2014-06-02 Found nothing 14
sophos 5.04 3.51.0 2014-08-05 Found nothing 9
sunbelt 3.9.2589.2 3.9.2589.2 2014-06-13 Found nothing 5
symantec 20141111.002 1.3.0.24 2014-11-11 Found nothing 2
tachyon 9.9.9 9.9.9 2013-12-27 Found nothing 8
thehacker 6.8.0.5 6.8.0.5 2014-06-12 Found nothing 6
tws 17.47.17308 1.0.2.2108 2014-06-16 Found nothing 12
vba 3.12.26.3 3.12.26.3 2014-11-12 Found nothing 6
virusbuster 15.0.965.0 5.5.2.13 2014-11-11 Found nothing 15
权限列表
许可名称 信息
android.permission.SYSTEM_ALERT_WINDOW 显示系统窗口
android.permission.RECEIVE_BOOT_COMPLETED 接收开机启动广播
android.permission.WRITE_SMS 写短信
android.permission.ACCESS_NETWORK_STATE 读取网络状态(2G或3G)
android.permission.INTERNET 连接网络(2G或3G)
android.permission.READ_PHONE_STATE 读取电话状态
android.permission.READ_LOGS 读取系统日志
android.permission.ACCESS_WIFI_STATE 读取wifi网络状态
android.permission.GET_TASKS 获取有关当前或最近运行的任务信息
android.permission.WRITE_EXTERNAL_STORAGE 写外部存储器(如:SD卡)
android.permission.READ_EXTERNAL_STORAGE 读外部存储器(如:SD卡)
android.permission.WRITE_SETTINGS 读写系统设置项
android.permission.KILL_BACKGROUND_PROCESSES 关闭后台进程
android.permission.RECEIVE_SMS 监控接收短信
android.permission.CHANGE_WIFI_STATE 改变WIFI连接状态
android.permission.READ_CONTACTS 读取联系人信息
android.permission.WRITE_CONTACTS 写入联系人信息
android.permission.READ_CALL_LOG 读取通话记录
android.permission.WRITE_CALL_LOG 写入通话记录
android.permission.ACCESS_FINE_LOCATION 获取精确的位置(通过GPS)
android.permission.ACCESS_COARSE_LOCATION 获取粗略的位置(通过wifi、基站)
android.permission.CALL_PHONE 拨打电话
android.permission.PROCESS_OUTGOING_CALLS 监视、修改有关拨出电话
android.permission.RECEIVE_MMS 接收彩信
android.permission.RECEIVE_WAP_PUSH 接收wap push信息
android.permission.SEND_SMS 发送短信
android.permission.READ_SMS 读取短信
android.permission.MODIFY_PHONE_STATE 修改电话状态
android.permission.MODIFY_AUDIO_SETTINGS 修改声音设置
android.permission.VIBRATE 允许设备震动
android.permission.BATTERY_STATS 电量统计
android.permission.GET_PACKAGE_SIZE 获取应用大小
com.android.launcher.permission.READ_SETTINGS 读取快捷方式信息
android.permission.WAKE_LOCK 手机屏幕关闭后后台进程仍运行
android.permission.CHANGE_NETWORK_STATE 变更网络状态
android.permission.RESTART_PACKAGES 重启其他程序
android.permission.WRITE_SECURE_SETTINGS 读写系统敏感设置
android.permission.READ_SYNC_SETTINGS 读取同步设置
android.permission.WRITE_SYNC_SETTINGS 写入同步设置
android.permission.WRITE_APN_SETTINGS 改写APN设置(如:cmwap)
android.permission.BLUETOOTH_ADMIN 搜寻蓝牙设备
android.permission.RECORD_AUDIO 录音(使用AudioRecord)
com.android.launcher.permission.INSTALL_SHORTCUT 创建快捷方式
com.android.launcher.permission.UNINSTALL_SHORTCUT 删除快捷方式
android.permission.BLUETOOTH 连接蓝牙设备
android.permission.CLEAR_APP_CACHE 清除应用缓存
android.permission.GET_ACCOUNTS 访问账户列表
android.permission.CAMERA 访问照相机设备
android.permission.INTERACT_ACROSS_USERS_FULL
com.qihoo.antivirus.permission.broadcast
com.android.browser.permission.READ_HISTORY_BOOKMARKS 读取浏览器书签
com.android.browser.permission.WRITE_HISTORY_BOOKMARKS 写浏览器书签
文件信息
VirSCANVirSCAN
安全评分 :72
基本信息
VirSCANVirSCAN
MD5:5c55196e5c2eca5fb85063df81db58bc
文件大小:5.58MB
上传时间: 2014-09-22 10:36:30 (CST)
包名:com.qihoo.antivirus
最低运行环境:Android 2.3, 2.3.1, 2.3.2
版权:Qihoo
关键行为
VirSCANVirSCAN
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Button]
[Window,Class] = [老A卖家工具箱,Static]
[Window,Class] = [老A卖家工具箱 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [显示细节(&D),Button]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [老A云提醒1.06---星仔:你的私人时间秘书,有效利用时间,提高执行力!,#32770]
[Window,Class] = [,tooltips_class32]
行为描述: 按名称获取主机地址
详情信息: pt.13980.com
行为描述: 在桌面创建快捷方式
详情信息: C:\Documents and Settings\Administrator\桌面\老A卖家工具箱.lnk
行为描述: 获取文件属性探测VMware
详情信息: GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmacthlp.exe
GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmupgradehelper.exe
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 查找指定内核模块
详情信息: lstrcmpiA: ntice.sys <------> ntkrnlpa.exe (ntice.sys)
lstrcmpiA: ntice.sys <------> hal.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> KDCOM.DLL (ntice.sys)
lstrcmpiA: ntice.sys <------> BOOTVID.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> ACPI.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> WMILIB.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> pci.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> isapnp.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> compbatt.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> BATTC.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> intelide.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> MountMgr.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> ftdisk.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> dmload.sys (ntice.sys)
行为描述: 查找反病毒常用工具窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述: 修改注册表_启动项
详情信息: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laoatool
进程行为
VirSCANVirSCAN
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Button]
[Window,Class] = [老A卖家工具箱,Static]
[Window,Class] = [老A卖家工具箱 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [显示细节(&D),Button]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [老A云提醒1.06---星仔:你的私人时间秘书,有效利用时间,提高执行力!,#32770]
[Window,Class] = [,tooltips_class32]
行为描述: 按名称获取主机地址
详情信息: pt.13980.com
行为描述: 在桌面创建快捷方式
详情信息: C:\Documents and Settings\Administrator\桌面\老A卖家工具箱.lnk
行为描述: 获取文件属性探测VMware
详情信息: GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmacthlp.exe
GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmupgradehelper.exe
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 查找指定内核模块
详情信息: lstrcmpiA: ntice.sys <------> ntkrnlpa.exe (ntice.sys)
lstrcmpiA: ntice.sys <------> hal.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> KDCOM.DLL (ntice.sys)
lstrcmpiA: ntice.sys <------> BOOTVID.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> ACPI.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> WMILIB.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> pci.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> isapnp.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> compbatt.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> BATTC.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> intelide.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> MountMgr.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> ftdisk.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> dmload.sys (ntice.sys)
行为描述: 查找反病毒常用工具窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述: 修改注册表_启动项
详情信息: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laoatool
文件行为
VirSCANVirSCAN
行为描述: 在系统敏感位置(如开始菜单等)释放链接或快捷方式
详情信息: C:\Documents and Settings\Administrator\「开始」菜单\程序\老A卖家工具箱\老A卖家工具箱.lnk
C:\Documents and Settings\Administrator\「开始」菜单\老A卖家工具箱.lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\老A卖家工具箱\Website.lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\老A卖家工具箱\Uninstall.lnk
行为描述: 创建可执行文件
详情信息: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\InstallOptions.dll
C:\WINDOWS\laoatool\7-zip.dll
C:\WINDOWS\laoatool\7z.dll
C:\WINDOWS\laoatool\7z.exe
C:\WINDOWS\laoatool\autoupdate.exe
C:\WINDOWS\laoatool\laoatool.exe
C:\WINDOWS\laoatool\sqlite3.dll
C:\WINDOWS\laoatool\tdtdb.dll
C:\WINDOWS\laoatool\tdtpublic.dll
C:\WINDOWS\laoatool\tdtver.dll
C:\WINDOWS\laoatool\tool\CCleaner.exe
C:\WINDOWS\laoatool\tool\CFX32.OCX
C:\WINDOWS\laoatool\tool\TeeChart8.ocx
C:\WINDOWS\laoatool\tool\MSHFLXGD.OCX
C:\WINDOWS\laoatool\tool\msflxgrd.ocx
行为描述: 在桌面创建快捷方式
详情信息: C:\Documents and Settings\Administrator\桌面\老A卖家工具箱.lnk
行为描述: 写权限映射文件
详情信息: {5FBE0B2E-3D54-4A02-A07F-C8210DEDCA88}
{2C51FE8B-031B-454f-BF9C-0093743A43B4}
AtlDebugAllocator_FileMappingNameStatic_100_5c0
行为描述: 设置特殊文件夹属性
详情信息: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
行为描述: 修改文件内容
详情信息: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 36
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\modern-wizard.bmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 124
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 33
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 43
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 60
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 277
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 317
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 372
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 380
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 392
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 225
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 341
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\ioSpecial.ini---> Offset = 625
网络行为
VirSCANVirSCAN
行为描述: 连接指定站点
详情信息: InternetConnectA: ServerName = pt.13980.com, PORT = 80
InternetConnectA: ServerName = bbs.13980.com, PORT = 80
行为描述: 读取网络文件
详情信息: hFile = 0x0000030c, BytesToRead =1024, BytesRead = 1024.
hFile = 0x00000344, BytesToRead =1024, BytesRead = 1024.
hFile = 0x000002fc, BytesToRead =1024, BytesRead = 1024.
hFile = 0x000002c8, BytesToRead =1024, BytesRead = 1024.
hFile = 0x00000284, BytesToRead =1024, BytesRead = 1024.
行为描述: 打开HTTP请求
详情信息: HttpOpenRequestA: pt.13980.com:80/ping.txt?t=1377750, hConnect = 0x00000344
HttpOpenRequestA: pt.13980.com:80/client/index.php?m=poptip&a=fetch&user=, hConnect = 0x0000030c
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=57, hConnect = 0x00000344
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=59, hConnect = 0x0000030c
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=61, hConnect = 0x00000344
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=63, hConnect = 0x00000344
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=65, hConnect = 0x000002fc
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=67, hConnect = 0x00000344
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=53, hConnect = 0x000002fc
HttpOpenRequestA: bbs.13980.com:80/api.php?mod=js&bid=69, hConnect = 0x000002c8
HttpOpenRequestA: pt.13980.com:80/ping.txt?t=1385125, hConnect = 0x00000270
行为描述: 按名称获取主机地址
详情信息: pt.13980.com
注册表行为
VirSCANVirSCAN
行为描述: 修改注册表
详情信息: \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\X\BaseClass
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\laoatool.exe\
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\DisplayName
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\UninstallString
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\DisplayIcon
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\DisplayVersion
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\URLInfoAbout
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\laoatool\Publisher
\REGISTRY\MACHINE\SOFTWARE\Taodengta\Install Path
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Microsoft\Multimedia\DrawDib\vga.drv 1676x885x32(BGR 0)
行为描述: 删除注册表键
详情信息: \REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW
行为描述: 修改注册表_延迟重命名项
详情信息: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations
行为描述: 删除注册表键值
详情信息: \REGISTRY\MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW\DWFileTreeRoot
行为描述: 修改注册表_启动项
详情信息: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laoatool
其他行为
VirSCANVirSCAN
行为描述: 设置对象安全信息
详情信息: d:\laoatool\AppData
行为描述: 创建互斥体
详情信息: oleacc-msaa-loaded
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Button]
[Window,Class] = [老A卖家工具箱,Static]
[Window,Class] = [老A卖家工具箱 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [显示细节(&D),Button]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [老A云提醒1.06---星仔:你的私人时间秘书,有效利用时间,提高执行力!,#32770]
[Window,Class] = [,tooltips_class32]
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [TaodengtaTray,]
NtUserFindWindowEx: [Class,Window] = [18467-41,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
行为描述: 枚举窗口
详情信息: N/A
行为描述: 获取系统权限
详情信息: SE_LOAD_DRIVER_PRIVILEGE
行为描述: 查找指定内核模块
详情信息: lstrcmpiA: ntice.sys <------> ntkrnlpa.exe (ntice.sys)
lstrcmpiA: ntice.sys <------> hal.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> KDCOM.DLL (ntice.sys)
lstrcmpiA: ntice.sys <------> BOOTVID.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> ACPI.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> WMILIB.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> pci.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> isapnp.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> compbatt.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> BATTC.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> intelide.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> MountMgr.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> ftdisk.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> dmload.sys (ntice.sys)
行为描述: 窗口信息
详情信息: Pid = 1972, Hwnd=0xc01d6, Text = 下一步(&N) >, ClassName = Button.
Pid = 1972, Hwnd=0xd01c8, Text = 取消(&C), ClassName = Button.
Pid = 1972, Hwnd=0xa018c, Text = 老A卖家工具箱 , ClassName = Static.
Pid = 1972, Hwnd=0xe016e, Text = 老A卖家工具箱, ClassName = Static.
Pid = 1972, Hwnd=0xb01ce, Text = 欢迎使用“老A卖家工具箱”安装向导, ClassName = Static.
Pid = 1972, Hwnd=0xd01ac, Text = 这个向导将指引你完成“老A卖家工具箱”的安装进程。 在开始安装之前,建议先关闭其他所有应用程序。这将允许“安装程序”更新指定的系, ClassName = Static.
Pid = 1972, Hwnd=0xd0166, Text = 老A卖家工具箱 安装, ClassName = #32770.
Pid = 1972, Hwnd=0xb01de, Text = < 上一步(&P), ClassName = Button.
Pid = 1972, Hwnd=0xc01d6, Text = 安装(&I), ClassName = Button.
Pid = 1972, Hwnd=0xd01a4, Text = 选择安装位置, ClassName = Static.
Pid = 1972, Hwnd=0xc01e8, Text = 选择“老A卖家工具箱”的安装文件夹。, ClassName = Static.
Pid = 1972, Hwnd=0xe01ac, Text = d:\laoatool, ClassName = Edit.
Pid = 1972, Hwnd=0xc01ce, Text = 浏览(&B)..., ClassName = Button.
Pid = 1972, Hwnd=0xc0170, Text = 可用空间: 16.4GB, ClassName = Static.
Pid = 1972, Hwnd=0xb0192, Text = 所需空间: 53.6MB, ClassName = Static.
行为描述: 查找反病毒常用工具窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述: 获取文件属性探测VMware
详情信息: GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmacthlp.exe
GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmupgradehelper.exe
行为描述: 内联HOOK
详情信息: C:\WINDOWS\system32\ntdll.dll--->DbgBreakPoint Offset = 0x0
C:\WINDOWS\system32\GDI32.dll--->ExtTextOutA Offset = 0x0
C:\WINDOWS\system32\GDI32.dll--->ExtTextOutW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->BeginPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->EndPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->ReleaseDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->WindowFromDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollInfo Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollPos Offset = 0x0
行为描述: 搜索kernel32.dll基地址
详情信息: Instruction Address = 0x00611a73
Instruction Address = 0x0050ca92
行为描述: 打开图片文件
详情信息: \DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\modern-wizard.bmp
\windows\laoatool\tsoft\html\images\icon_1.jpg
行为描述: 尝试打开调试器或监控软件的驱动设备对象
详情信息: \??\SICE
\??\SIWVID
\??\NTICE
异常崩溃
VirSCANVirSCAN
行为描述: 设置对象安全信息
详情信息: d:\laoatool\AppData
行为描述: 创建互斥体
详情信息: oleacc-msaa-loaded
行为描述: 隐藏指定窗口
详情信息: [Window,Class] = [,Button]
[Window,Class] = [老A卖家工具箱,Static]
[Window,Class] = [老A卖家工具箱 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [显示细节(&D),Button]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [,#32770]
[Window,Class] = [,ComboLBox]
[Window,Class] = [老A云提醒1.06---星仔:你的私人时间秘书,有效利用时间,提高执行力!,#32770]
[Window,Class] = [,tooltips_class32]
行为描述: 查找指定窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [TaodengtaTray,]
NtUserFindWindowEx: [Class,Window] = [18467-41,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
行为描述: 枚举窗口
详情信息: N/A
行为描述: 获取系统权限
详情信息: SE_LOAD_DRIVER_PRIVILEGE
行为描述: 查找指定内核模块
详情信息: lstrcmpiA: ntice.sys <------> ntkrnlpa.exe (ntice.sys)
lstrcmpiA: ntice.sys <------> hal.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> KDCOM.DLL (ntice.sys)
lstrcmpiA: ntice.sys <------> BOOTVID.dll (ntice.sys)
lstrcmpiA: ntice.sys <------> ACPI.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> WMILIB.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> pci.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> isapnp.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> compbatt.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> BATTC.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> intelide.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS (ntice.sys)
lstrcmpiA: ntice.sys <------> MountMgr.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> ftdisk.sys (ntice.sys)
lstrcmpiA: ntice.sys <------> dmload.sys (ntice.sys)
行为描述: 窗口信息
详情信息: Pid = 1972, Hwnd=0xc01d6, Text = 下一步(&N) >, ClassName = Button.
Pid = 1972, Hwnd=0xd01c8, Text = 取消(&C), ClassName = Button.
Pid = 1972, Hwnd=0xa018c, Text = 老A卖家工具箱 , ClassName = Static.
Pid = 1972, Hwnd=0xe016e, Text = 老A卖家工具箱, ClassName = Static.
Pid = 1972, Hwnd=0xb01ce, Text = 欢迎使用“老A卖家工具箱”安装向导, ClassName = Static.
Pid = 1972, Hwnd=0xd01ac, Text = 这个向导将指引你完成“老A卖家工具箱”的安装进程。 在开始安装之前,建议先关闭其他所有应用程序。这将允许“安装程序”更新指定的系, ClassName = Static.
Pid = 1972, Hwnd=0xd0166, Text = 老A卖家工具箱 安装, ClassName = #32770.
Pid = 1972, Hwnd=0xb01de, Text = < 上一步(&P), ClassName = Button.
Pid = 1972, Hwnd=0xc01d6, Text = 安装(&I), ClassName = Button.
Pid = 1972, Hwnd=0xd01a4, Text = 选择安装位置, ClassName = Static.
Pid = 1972, Hwnd=0xc01e8, Text = 选择“老A卖家工具箱”的安装文件夹。, ClassName = Static.
Pid = 1972, Hwnd=0xe01ac, Text = d:\laoatool, ClassName = Edit.
Pid = 1972, Hwnd=0xc01ce, Text = 浏览(&B)..., ClassName = Button.
Pid = 1972, Hwnd=0xc0170, Text = 可用空间: 16.4GB, ClassName = Static.
Pid = 1972, Hwnd=0xb0192, Text = 所需空间: 53.6MB, ClassName = Static.
行为描述: 查找反病毒常用工具窗口
详情信息: NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述: 获取文件属性探测VMware
详情信息: GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmacthlp.exe
GetFileAttributes: FileName = c:\program files\vmware\vmware tools\vmupgradehelper.exe
行为描述: 内联HOOK
详情信息: C:\WINDOWS\system32\ntdll.dll--->DbgBreakPoint Offset = 0x0
C:\WINDOWS\system32\GDI32.dll--->ExtTextOutA Offset = 0x0
C:\WINDOWS\system32\GDI32.dll--->ExtTextOutW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongA Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->SetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowLongW Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->BeginPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->EndPaint Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetWindowDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->ReleaseDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->WindowFromDC Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollInfo Offset = 0x0
C:\WINDOWS\system32\USER32.dll--->GetScrollPos Offset = 0x0
行为描述: 搜索kernel32.dll基地址
详情信息: Instruction Address = 0x00611a73
Instruction Address = 0x0050ca92
行为描述: 打开图片文件
详情信息: \DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsz2.tmp\modern-wizard.bmp
\windows\laoatool\tsoft\html\images\icon_1.jpg
行为描述: 尝试打开调试器或监控软件的驱动设备对象
详情信息: \??\SICE
\??\SIWVID
\??\NTICE
危险行为
VirSCANVirSCAN
行为描述: 执行系统命令
详情信息: /data/user/0/com.qihoo.antivirus/files/librpc.so
{logcat, -d, -v, time, -t, 800, -f, logcat.txt}
动态列表行为
VirSCANVirSCAN
行为描述: 数据泄露
详情信息: sink:File operation:write data:data:724af8ef208274650de20d09b0e94dba
行为描述: 传递附加信息
详情信息: Ljava/lang/String;=_*_from_notify | Z=true
Ljava/lang/String;=from_extra | I=1
Ljava/lang/String;=_*_extra_redirectType | I=1
Ljava/lang/String;=from_extra | I=0
行为描述: 调用哈希算法
详情信息: MD5
行为描述: 读取文件
详情信息: path:/proc/840/cmdline length:105
path:/proc/840/cmdline length:105
path:/proc/798/cmdline length:105
path:/proc/810/cmdline length:105
path:/proc/840/cmdline length:105
path:/proc/853/cmdline length:105
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar length:9
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar length:22
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar length:99
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar length:7
path:/proc/cpuinfo length:105
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/hotel.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/finance.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/life.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/piao.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/operator.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/public.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/gc.idx.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/cellswitch.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/cellswitch.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/nbmodel.bin.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/v_city.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_city.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_city.dat length:8
path:/data/data/com.qihoo.antivirus/files/v_spam.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_spam.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_spam.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_spam_in.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_spam_in.dat length:9
path:/data/data/com.qihoo.antivirus/files/v_spam_in.dat length:8
path:/proc/860/cmdline length:105
path:/proc/860/cmdline length:105
path:/proc/860/cmdline length:105
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar.timestamp length:6
path:/data/data/com.qihoo.antivirus/shared_prefs/dual_config.xml length:105
path:/proc/meminfo length:105
path:/data/data/com.qihoo.antivirus/files/piao.idx length:39
path:/data/data/com.qihoo.antivirus/files/piao.idx length:105
path:/data/data/com.qihoo.antivirus/files/hotel.idx length:66
path:/data/data/com.qihoo.antivirus/files/hotel.idx length:105
path:/data/data/com.qihoo.antivirus/files/finance.idx length:40
path:/data/data/com.qihoo.antivirus/files/finance.idx length:105
path:/data/data/com.qihoo.antivirus/files/life.idx length:40
path:/data/data/com.qihoo.antivirus/files/life.idx length:105
path:/data/data/com.qihoo.antivirus/files/operator.idx length:36
path:/data/data/com.qihoo.antivirus/files/operator.idx length:105
path:/data/data/com.qihoo.antivirus/files/gc.idx length:87
path:/data/data/com.qihoo.antivirus/files/gc.idx length:105
path:/data/data/com.qihoo.antivirus/files/public.idx length:103
path:/data/data/com.qihoo.antivirus/files/public.idx length:105
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat length:6
path:/data/data/com.qihoo.antivirus/files/msgcnt.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/pseudo1.dat length:6
path:/data/data/com.qihoo.antivirus/files/cellswitch.dat length:6
path:/data/data/com.qihoo.antivirus/files/cellswitch.dat length:6
path:/proc/876/cmdline length:105
path:/proc/901/cmdline length:105
path:/proc/901/cmdline length:105
path:/proc/901/cmdline length:105
path:/proc/925/cmdline length:105
path:/proc/925/cmdline length:105
path:/proc/925/cmdline length:105
path:/proc/949/cmdline length:105
path:/proc/949/cmdline length:105
path:/proc/973/cmdline length:105
path:/proc/973/cmdline length:105
path:/proc/997/cmdline length:105
path:/proc/997/cmdline length:105
path:/proc/949/cmdline length:105
path:/proc/973/cmdline length:105
path:/proc/997/cmdline length:105
path:/proc/1033/cmdline length:105
path:/proc/1035/cmdline length:105
path:/proc/1044/cmdline length:105
path:/proc/1044/cmdline length:105
path:/proc/1074/cmdline length:105
path:/proc/1074/cmdline length:105
path:/proc/1044/cmdline length:105
path:/proc/1074/cmdline length:105
path:/proc/1094/cmdline length:105
path:/proc/1118/cmdline length:105
path:/proc/1094/cmdline length:105
path:/proc/1131/cmdline length:105
path:/proc/1094/cmdline length:105
path:/proc/1118/cmdline length:105
path:/proc/1118/cmdline length:105
path:/proc/1137/cmdline length:105
path:/proc/1137/cmdline length:105
path:/proc/1137/cmdline length:105
path:/proc/1182/cmdline length:105
path:/proc/1184/cmdline length:105
行为描述: 启动服务
详情信息: com.android.musicfx.Compatibility$Service
com.android.mms.transaction.SmsReceiverService
com.qihoo.antivirus.server.app.CoreService
行为描述: 对指定数据计算哈希
详情信息: com.qihoo.antivirus
357242043237511
com.qihoo.antivirus_100
行为描述: 数据加密
详情信息: {u'operation': u'keyalgo', u'algorithm': u'DES', u'key': u'96, 71, 37, 15, -101, -128, 21, -66'}
{u'operation': u'keyalgo', u'algorithm': u'DES', u'key': u'117, 74, 105, -88, 91, 14, -78, 82'}
{u'operation': u'encryption', u'data': u'357242043237511', u'algorithm': u'DES'}
{u'operation': u'keyalgo', u'algorithm': u'DES', u'key': u'98, 42, 115, 45, 97, 105, 108, 101'}
{u'operation': u'decryption', u'data': u'*|10086.cn', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|qq,weixin.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u624b\u673a\u536b\u58eb,360.cn', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u6b22\u8fce\u767b\u9646,cmread.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u4e66\u5238\u6210\u529f,cmread.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u5c0a\u656c\u7684\u7528\u6237,cmread.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u60a8\u5df2\u6210\u529f\u53c2\u4e0e,cmread.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u5411\u60a8\u8d60\u9001,cmread.com', u'algorithm': u'DES'}
{u'operation': u'decryption', u'data': u'*|\u60a8\u5df2\u6210\u529f\u8ba2\u8d2d,cmread.com', u'algorithm': u'DES'}
行为描述: 类加载
详情信息: path:/system/app/PicoTts.apk
path:/system/app/MusicFX.apk
path:/system/framework/am.jar
path:/data/app/com.qihoo.antivirus-1.apk
path:/data/data/com.qihoo.antivirus/files/Dual/dmss_v2.jar
path:/data/user/0/com.qihoo.antivirus/files/Dual/dmss_v2.jar
行为描述: 执行SQL查询
详情信息: select
行为描述: 注册ContentObserver
详情信息: URI=content://com.qihoo360.mobilesafeguard_lite/smartwhite
URI=content://com.qihoo360.mobilesafeguard_lite/whitelist
URI=content://com.qihoo360.mobilesafeguard_lite/whitelistcard2
URI=content://com.qihoo360.mobilesafeguard_lite/blacklist
URI=content://com.qihoo360.mobilesafeguard_lite/blacklistcard2
URI=content://call_log/calls
URI=content://sms
URI=content://mms-sms/
URI=content://settings/system/screen_brightness
行为描述: 执行系统命令
详情信息: /data/user/0/com.qihoo.antivirus/files/librpc.so
{logcat, -d, -v, time, -t, 800, -f, logcat.txt}
行为描述: 缓冲区读取一行数据
详情信息: com.qihoo.antivirus
com.qihoo.antivirus:server
MemTotal: 841036 kB
null
1
00000.*
10000.*
.*0000000000
unknown
9774d56d682e549c
52443443484950
739463
0123456789.*
004999010640000
355195000000017
001068000000006
8552502717594321
358673013795895
355692547693084
004400152020000
113456798945455
012379000772883
111111111111119
358701042909755
358000043654134
345630000000115
356299046587760
135790246811220
6723,
1876,
1869,
1868,
1809,
1784,
1767,
1758,
1671,
1664,
1649,
1481,
1473,
1441,
1345,
1340,
1284,
1268,
1264,
1246,
1242,
998,
996,
995,
994,
993,
992,
977,
976,
975,
974,
973,
972,
971,
968,
967,
966,
965,
964,
963,
962,
961,
960,
886,
880,
856,
855,
853,
852,
850,
692,
691,
690,
689,
688,
687,
686,
685,
684,
683,
682,
681,
680,
679,
678,
677,
676,
675,
674,
673,
672,
599,
598,
597,
596,
595,
594,
593,
592,
591,
590,
509,
508,
507,
506,
505,
504,
503,
502,
501,
500,
423,
421,
420,
389,
387,
386,
385,
381,
380,
379,
378,
377,
376,
375,
374,
373,
372,
371,
370,
359,
358,
357,
356,
355,
354,
353,
352,
351,
350,
299,
298,
297,
291,
290,
269,
268,
267,
266,
265,
264,
263,
262,
261,
260,
258,
257,
256,
255,
254,
253,
252,
251,
250,
249,
248,
245,
244,
243,
242,
241,
240,
239,
238,
237,
236,
235,
234,
233,
232,
231,
230,
229,
228,
227,
226,
225,
224,
223,
222,
221,
220,
218,
216,
213,
212,
98,
95,
94,
93,
92,
91,
90,
86,
84,
82,
81,
73,
66,
65,
64,
63,
62,
61,
6722,
6724,
60,
58,
57,
56,
55,
54,
53,
52,
51,
49,
48,
47,
46,
45,
44,
43,
41,
40,
39,
36,
34,
33,
32,
31,
30,
27,
20,
7,
019,IP
1,/
10657109080335
0085388895566
01085294411
02129907206
057195569
07185950713
07188428184
07188901932
076022432146
076085977280
08986167988677635
10000
10010
10011
10086
10086000
10086003
10086006
1008601333
10086901
10086977
10116*
10620121
1062012110
10621111
1063*
10650220966666
106550105375
1065502182061*
10655059114185998
10655059282116512*
10655059370*
1065505937276360*
1065505986200107
106550773995135*
10655101909
1065510198
10655111
106558350*
106558366*
1065586514*
106558717
1065588788
106558888
1065596130*
106559999
10657050*
10657061*
106570706666*
106570791*
10657109093504
10657109158899
1065711820*
106571203605
106571206203
106573072105*
10657500005339170087
1065750000597682117
10657500010*
106575000360
106575000410
10657500042*
10657500047*
106575000521
106575000554
1065750006650*
106575010027188
106575010067
106575010096116512*
106575011649166
106575011679535*
106575020344*
106575160705*
1065751610909
106575166699107
106575168201
10655*80670
10659*77038
106575218052*
10657532138*
106575555108*
106575555505
10658000*
10658008*
10658080
1065810398360
106581781*
106582068
10658218*