魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :34: :37: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 K

Size: px

Start display at page:

Download "魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :34: :37: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 K"

示富
5 years ago
Views:

魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL 2016-11-26 14:34:36 2016-11-26 14:37:02 146 秒 1.

$c:\users\test\appdata\local\microsoft\windows\temporary internet files\antiphishing\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.$ $dat file: c:\users\test\appdata\roaming\microsoft\windows\iecompatcache\index.$ 51.la 灰名单: icon.51.la 灰名单: web.51.la 魔盾wping.org IP地址信誉系统灰名单: 118.193.217.133 运行截图网络分析访问主机记录直接访问 IP地址国家名否 42.236.74.

51.la 灰名单: icon.51.la 灰名单: web.51.la 魔盾wping.org IP地址信誉系统灰名单: 118.193.217.133 运行截图网络分析访问主机记录直接访问 IP地址国家名否 42.236.74.

1 魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :34: :37: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 KVM :34: :37:02 魔盾分数 3.65 可疑的 URL信息 URL wbmfp.com VirusTotal VirusTotal链接 VirusTotal扫描时间: :49:59 扫描结果: 0/67 (展开) 特征投放了一个或多个文件 file: c:\users\test\appdata\local\microsoft\windows\temporary internet files\antiphishing\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat file: c:\users\test\appdata\local\microsoft\feeds cache\index.dat file: c:\users\test\appdata\roaming\microsoft\windows\iecompatcache\index.dat 网络活动包含通用钓鱼特征可能被用于网站克隆 Page cloned from: 魔盾wping.org 域名信誉系统黑名单: js.users.51.la 灰名单: icon.51.la 灰名单: web.51.la 魔盾wping.org IP地址信誉系统灰名单: 运行截图网络分析访问主机记录直接访问 IP地址国家名否 China 否 China 否 China 否 China 域名解析域名响应 wbmfp.com A js.users.51.la A A icon.51.la A web.51.la A A CNAME web2.51la.my-free.info A A A A A CNAME web1.51.la A A

2 TCP 连接 IP 地址端口 UDP 连接 IP 地址端口 HTTP 请求 URL

41 投放文件 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 fbe6ba880d1f6cadfd f2c73 34b1a30160c6c7675a5c69b62d98661ab7a494bb a2cdabb3fc43f2e94ca47fac764eea bdf094690a6369be41fc4a5fd01

42 SHA512 Ssdeep Yara VirusTotal 6a28d50bc6feeee26b35f014de7c8462d584bea98e9d6c97ebcedd2f22af71c4006cac f4b6e25ad6e7f44f067b3f983113e078104f27ec02b1a4d0ab 768:pFFwZHojCtOlWNw3nsiMsieuugxdKOri:rFwZIjCtkWm3siMbeuugxdKoi 无匹配搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\Cookies\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 76dae a4e7318d70e61b0c5574 fc7247feab37cc744b2c892034c0809ca88385b6 54fe36b5a8e5f9f37a5a9ce85102a06d5b66782bd5046d df09c112ef e154bc2b4fa3af93922b893fe9ba8da c2076c5576e5c0be200855b2fd87ad2482f9c4e94c77f8bcff6c ac98d25db79dd58aa92ebd1a :SFQiUPTSQCkCVCSsZseIuoV/zYBFYfA60G:diGSQCkCVCSsyeIuoV/zYjYfD0G 无匹配搜索相关分析 2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat bytes data 27815a8d1b8ccf820cafa774bc60319d b5cf0c73f7620c0b3dce47a49ecc e4ba 457f1dca63cbbdec5fb31b37c805a50bb917306ab738061c26bb69d19bedc7c5 ed85a6dab4c61b23eb acf0101fb1ef057ec35b0d4fcd169201c33d77336ef254629c14a57da4f8d79e223ddcec27b2a6f92bf26f5041e86f31f88d19c 6:k2v0Jqsast6Y3WUBrMeqUBlqYIHlx3FWUBFpQll7kLln9sve56dj5ob:khJqsaM75QeNlrIlVslBkRnz56s 无匹配搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 0aee387ca0a52dcdd8f8a29ea76edb42 5df81547dcadb2a7b8bc689da8e1383ba1a84cb9 c31bc37e102b70a472837d530ec80bdaea28b0fefda3e9aa8c8cda98c4200c4e 101bdb7178e031b1fbd78d595d778d cdcb70eb4b92af534910e30e ec319bccecf7a105c814b6b32c077a777fb5e90bd1459c78dcdf9 12:qjtSaFpbZli3zIoYDPO7em4GZj03W/cKYDPOCG5A30WUsOXQDG9YRm4GZ5:qj4avEIoYTCebGZ7ZYTlEJ0oQQ4bGZ 无匹配搜索相关分析 common_ec85305[1].css 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal common_ec85305[1].css C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\common_ec85305[1].css bytes UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators 1a7f73ebd47b95768f7f4f feaca23a8e48cdcba4927f3a6e7e532e46291a ed54afff9d22abe604b4f0cee44bc e8e833ce544347ad463a2f1ac 049fcf8198bff37b30d83cdd1a110cb5da6c3709b148ebf0e65b27f f1668c357c9738c2d7dfaa f06a4f4d386ccf5e7530d07b12d8421fddd7 384:nnwMjcRCRCPgWbzI9KKTZJE3HAVdcBym2dcBvmF2nqwDkdcB1l3v4Y/DHiELe4zL:w/PgM0koZyAkymZvmF2pDn1ldbi4f 无匹配搜索相关分析 6[1].jpg 文件名相关文件文件大小 6[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\6[1].jpg 1874 bytes 文件类型 JPEG image data, JFIF standard 1.01

43 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 1dff069b1434a7263b4325f0068d0da7 e5a71b163b8a1a81dab e31a484befe8 0e ea4b db5300f4784c2fa9e c291c a cfd3592a079e1fa0d43c6f0ede0be552e89712d935cbcafc68534a560b9fd7da2c649aba5fa910d22b771103fa06dd287b399aa45ca1f0e7088f3d56b2038aea 48:xOWZTgWSUmqHqIrmJahxRh+BF+wHhYYkQ1h+x:/1gdUlRgPnVc 无匹配搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 82a befad2e0fd d 9694d4ce64c880b2b3e1fa893b80b5e6d57b43e9 4c3a5182bccf1a9a2eda85b ce4b7eb4518ec74e23c359eb8f3703 c6418fa497fae667acfa474847bf6e57885d363116e9f8dbeb3c578ea08a28e92ef2b5a69e23eb510a d2c04dcc182dcf6a22fdcf8d :wEEG/+o+cIL1j53sevQ9u4YlO1KYxm7BSY/ZFW1jsCvbD1Q+jU3+Z0ZZX06nfaMA:wEEG/+RE 无匹配搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal ba028aaf469a9f91854b4fbc d f230bbd5cd b8ef01f1dfa785f9872c ffcf3f20c05ca4a8b8a95fb77be0914dcd7764e41cb54f13e405b12ef5d80 eeff064200a ff098836e2681bac12e81ea1a3e2e75355aec36938bab97e66c6c0c93211c7fd736e90a4285eb417cfd8404ef0143f33bb c807 12:qjVO1y3wfRXOV43Q+p20Ki39Qv6qPwL2l0:qjg1vfR8Z+YD/o6l 无匹配搜索相关分析 19[1].png 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 19[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\19[1].png 5067 bytes PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced 6b79d7288dfdf5ec98b21593e2918c36 5b538849d9e3e fa0f2d89ee d02522f74e06d123a2b269e640860e2300b40162d8821b7c71bf43a95ab1db1c e65e0aa91c19bc6eb9d770cbd1d1485fffa5748defa2002be420cf51418d5b3f57b2fba3d4715d08cfef03cd85dc319d9105ecf4f3e2e94a74ced33ab2fd648d 96:wSDZ/I09Da01l+gmkyTt6Hk8nTIv4k96QrU2mL+LhBUUkR0Ft:wSDS0tKg9E05TDu6VKhxt 无匹配搜索相关分析 14[1].jpg 文件名相关文件文件大小 14[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\14[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal b2b68dda64f9a a f220761b7a58e935b4728bfa2f523fd95b 3e4d7d34c696f22b34b61da19b27f7116d456480c5d019f5896c084534edd ce80a955d07e4498c753a3b29b208db08d80af59b5a6d6acd4fbc c7a6eb8f64ee26feb14860a04a1197ec4bee ba4866f67aa :W+kR5nUZBs5F/WLiEtp+HscwpY8dHv9N3ts5nVsRe/9jpCzIAkUnP:Y3WBseiw+Hs/Y8NT65n1paISP 无匹配搜索相关分析 10[1].jpg

44 文件名相关文件文件大小 10[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\10[1].jpg 2144 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal c3ec03bb5de0d03eb0ecf64f6aadbe35 dddc796e6849e694f07f453ae23c3471c4aac7ae c12e66d7da8a1aece52ee5ad44ee3c bc77f e5fc107c87f6c 97aecdb973d2e3bef ca66f9dffb0c7fce1bc7b3ef79552e3a288edc f88f7f9e4eeac8c53c4dd6ef d741edb12cf6caaf186db72 48:xNy72LjG0iS1qk4eOOnhnKavrI2rWZW1SJ2ycn5sN8L1Ohgu8Ji:zywG0iKl4PChdPGUyciNIokJi 无匹配搜索相关分析 4[1].jpg 文件名相关文件文件大小 4[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\4[1].jpg 1099 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 759f8ade066e9c1095a580f29d3bfacb b7b3adbbf58d79829aabe5db88bb373fa18524dd eb295fdf ca10af0dc7d70cf08a9fa77aedb849f8e15e7a6c46bf84 d01b5ff b8b c87d1047c275bfc62b07ba83fb04b937fb60994fb0e97f287a7f5bfa5ebeb42ae34159ba5aaa1e2e bd7cfc :xQMbRwDElvPVf4Xa0IalJxxFaMo03C5piXT5DTIt0J3cED:xp5df4zIUxxNC5piXTutBE 无匹配搜索相关分析 3[1].jpg 文件名相关文件文件大小 3[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\3[1].jpg 1370 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal b33a6a57343de12113aa2d5fbd0ea569 24b009b68d20433d5e01b658523fef d7d27f000909f44c81c6a7e30c4aca936a08e7d36699da a4ff ca76d3a5d4e2d b1350ab81d356f89a75a735b1f8ce23f2ad0e165376da1a108618d1e00a5b822a54ac98f4e9036fb1c947f7298b1600b485e3 24:xQRnWchlPrhzGIeILlh1UU1TYkTchBvswI+Vw+M+WSI:xlcvhibhoEuchGyVRM+W5 无匹配搜索相关分析 1[1].jpg 文件名相关文件文件大小 1[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\1[1].jpg 1393 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal fa3b7ad29c2d94773e577fffa dfff1bfcf58abb8fa57fa7747d89910ca32a5fda e69b6813ada0aecdb7c39dcaba8e011940f3f4f4a7e70bd6d1e d617bc 11b6ec fda36cfc96262e5790eaf57b09cf0fa9d504a067f809084c4991de8a9752ec87579cf1b4ec32eedca89c25fe9be18d17e053965f84fa0b4e81b 24:xQ3TqOE/T/qoLwkWRIHXZDp7k20F94vBt9U4xszZL:xlygSMpDKtg9UE8ZL 无匹配搜索相关分析 13[1].jpg 文件名相关文件文件大小 13[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\13[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep cc6461bb3289fc2323f95382eaac6a14 61a844b28763b793bbd15df3bfaa3c5fe8bf9458 ac6eb7be6b5bee3d90e7dc37af7c72c39ad7221f7451d699c594ce4d4377aa51 f3729b329c c4dc3b7dfb184aa32449bed7462ba6adfa51875f97c672afb7c9280f42bf94ff1dceedbac280e0c1ebade94dcfa6b86ceb871c576b0b :Zl9zYVhw+gIqK3/QFyt+ZSD40QdCr/KXeT4E/KQKsVXIaSkcdfUOIwSJ45S+2B:Dwqyy44Rdi/K1MYpj9UZwS20+E

45 Yara VirusTotal 无匹配搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep 2fcd29902d4864fc498b7fc6a9a05a5f 1816d12a85ec1e9c77815d159769f56aec361f03 737efc64a47a0099a8d5c3603c24b3762f4e c c1e1d4f 78fa d62d90aac f0a6f91b1694a34de6e355b381907bcfe f27d ad0f8daaa31f0e53be13f0c746a7e4b83db4a4d3042c :2dibnvRnKXUpsq6QRJi1hjo7dmU9buSQ+:2dibnvRnKXUpsq6QRJiTjoh Yara memory_shylock () NET () VirusTotal 搜索相关分析 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal d945ce1e4ed3dcece7bac9c95ba8ce12 d7bde496334c99f6fbd32fa3a8e9333e86a57ce3 8d0d f89dd21790c29383bad0cb7b3afe8989fd5f3db61a828dd8b82c9 9822f03d3296e51b8a f9c72188f66a38892adeb88b65ca1418a07397d6029b17dfd4e6e0d6c117eb304cbb82afef66902a738a112cbecdd9a85f2852a 192:JHYfGwZKQI2uUO8wLrMSyO08Oi6x8PzuE8:JH2PKQ6UOTq/rT6Pzu1 无匹配搜索相关分析 9[1].jpg 文件名相关文件文件大小 9[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\9[1].jpg 605 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal df67073f0630c910e305322ea8114e0d f7f80ddbdd9092ad409aadc5bef8ad688c db a bc753fce78ce60515ab1335b89a19000b09f310274d59e 78fb0ae69bfb e5d67bd1d9ed0693eb63efb76f44fb6906ecb7a341d080719c24d2a840b1f80f446a718c8ae93b7563d49c a3bdd8dc50fe0b3 12:tLOyPBpAJ3LlIb/TkabJz8rt6uSZy2Ys+B/24BH7vjn:xQIAMJzaf6/+BxBbr 无匹配搜索相关分析 MSIMGSIZ.DAT 文件名相关文件文件大小 MSIMGSIZ.DAT C:\Users\test\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT bytes 文件类型 FoxPro FPT, blocks size 0, next free block index MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 390ed1a51965b2bd4bac4ea a d bedd7bfebcbc70e4bdd7786ec29 46f682c4506bb74e7fe2a0d e1e8e9fb81bdc8f7fb3635ae1b02b 0ef02fda6125b26753e9b025e1b9a976c93e3bbd285b70d27b3b57eb74ac4f0a87cca9369ab becdef7fe93cc41150ea1c17b810a5a979bfabc6461bb 48:F7/WtOfjPd5ld4PzHPNGGl+oBuxf6vZRfuMS+Gdmzko8zZppKVO6vhUBs:FjWSPMvgmRfu+Ao8VDKVOch 无匹配搜索相关分析 8[1].jpg 文件名相关文件文件大小 8[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\8[1].jpg 1792 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 37d9ca6d3c80a82a ae464c9e

46 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal a5a1c9e719c21f6cc36cd06a4d3a849869efccce b3544e2e0a938407cdddab2a0aae2e44532c577fb6d9f27d8d7d167e0f09768d 8fa1bdb2e65c229636d6f702f773f e7e616cb19db2eaaeeac39e512b85894c5986f8b21099ae7ea8f01b886c7105e834ac76a06f7fe3c618e984785f4 48:xWlLIaEK5Sm1ceK6xot50pB1XhJQ4zVJS:WLTYAc8ot5E7Xk4zVJS 无匹配搜索相关分析 5[1].jpg 文件名相关文件文件大小 5[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\5[1].jpg 1558 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal b198139e60b216fb11f1389ac85c88c8 7e754ed4860cf333fc57f9b7915f13a6ee9aa0b4 6b49ad0a354332c0a10330ce0880a54c7dea79d30b544c7d639ed64064d9c27c 186baed82449e9aa2cf57e3f63d370c055a30c08e372f154a869c8612c9fa5f916366e052d95a6e1d1b024d8bc8d987d6e9729d9a798aa093b20cdc3603ea954 48:x5n34iEpsvLDn+xpDRObm6jK2ryaDOo3Bk:0i7D7+xxsbFjbyavk 无匹配搜索相关分析 17[1].png 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 17[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\17[1].png bytes PNG image data, 495 x 282, 8-bit/color RGBA, non-interlaced 62e55446adc09a160ffc9e3ac e23c85f5efd17d4c75103e15ab37f12d5ec db1e80c9bb6fe92dc5ec f74351ba8129d4c4136bd32b446a7d a3fb6371f eabd93129cbf3c29b3e253022ed4ac c8b4ce6c771918e2e9ea bffe852e2671c5352d93ed0d49e5ba1ab9954f7ab 3072:x5dRaCdZ/OoCIbAPuHa8X6FEVIgT11qEe43kB:iCjyzPuRX6FBI11hW 无匹配搜索相关分析 0[1].png 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 0[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\0[1].png 9017 bytes PNG image data, 84 x 80, 8-bit/color RGB, non-interlaced 64a034ead03e62b2fadf8b95fcbf4cdf 3bb851b8b3a53c9e1e8fd4133b4789f39a0b6be6 4a13ce1edaa0c1effa5d d94d92f341bf0ace0ded8b8194a418b635ec1 af39bb27e066e cf5fa87da0504f43a9f3d0db78df441169fb9ef45fd523ef2f918bd b6133a8ce73db3e67ab89fdb8f77661ee5 192:gcCM/9xLTGaMPGRCbY/dy5nn82UYKpZXgnSqPc5L5h8COeKLmDlQ:f7L16bidyFypVgnGDXKcq 无匹配搜索相关分析 15[1].jpg 文件名相关文件文件大小 15[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\15[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 101dce580151db491614a afbd d178ad2c9fbd8d0fb60ed eb6373ee0dfced5bc6ae1818ebf33aff604ec01836ae160d022f13da7f a6714a76ed7acfac4627db55dcc8ccef132da043fc6e61a6bf2c5d5132d3f943d7c0431b88fc09fee5e822b f8fbd39668eb7ebe065b :Zd7THl5ihOMMMMMM61gZoXviQE123SnD0txA2p:LScMMMMMMZZofp3w0tiG 无匹配搜索相关分析 fi000001[1].css 文件名相关文件 fi000001[1].css C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\fi000001[1].css

47 文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal bytes UTF-8 Unicode text, with very long lines, with no line terminators 07fbb51c4a18ab1e8ec762adf53bddca 98ab13b32c9cc5ced32ffd7cf1f18673b1d7c56d 0e da9cc93c797a56d035d5eb03092c3c477de2b12cc4e2a70ab7 fd6d1c2f96f42f89715bb72c2d547ad92ec6e13db96411cb1ba97fd63a8a0f7e44cc62f37d3c8c726691c e969871b756bac8b612c714ac1d83da73 384:jpV69Ptpbr5hyJrk38XxQ9v0yeoXA1S7lfoMmoaF2YcIQokIKf9c2GaB:ePr38XxQKMYglfoMmS1oTc9GaB 无匹配搜索相关分析 11[1].jpg 文件名相关文件文件大小 11[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\11[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 8b722f478b2306ea90a1ef2c cfda5a41ca4b2a95782e5dae51b527158acb56b 116a2a7acb04b35975f08ed d5ef2c f3017b1005f20a55 a7d0fe6a5e e8c2786e1d15a94f5b3a22c1782dfbef20997b1afa552a79cb27a3b47f4631f353395ac245f97d4ffc0dafed5dcff35655a8083f75710f8 768:aCftRayfTXh2Zv4NfXpBXL/INxzR/a4QZqlY7yajwjqq1MRgVe:aCVE42ZANxBcV84N/j4 无匹配搜索相关分析 44[1].gif 文件名相关文件文件大小 44[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\44[1].gif 1571 bytes 文件类型 GIF image data, version 89a, 24 x 24 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 5bc07c442a4e7f028effec5ba07abf6d dbdb7ce0f537d51804a34a6e68bcdd623 2e340f2e2c7cb05128b506ae158d4e5a251730d a6c891f a 46ef06e62f8cdf6f94831abb486a419789a5abe8e4f020c83162c433da2735a887b4644b0ad78aed94c8516ab411130fba547d76c78216cc4b7c13675e2b029d 48:HR5MEsHdNfp2ynSlj7SL0TEb5lE//zAFqr:HR922MSlj7SL0Tm5ls/Aqr 无匹配搜索相关分析 { B3A2-11E F29A}.dat 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal { B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ B3A2-11E F29A}.dat 4608 bytes Composite Document File V2 Document, No summary info c53e466864d a7eb98e7e4cb3b 71350e49b6993f6c8cd5b0287a04489e038a e7bf8d e1a5e10d96069f c31854a fa 3f7e43b1279a2b5dd513cf4f8358e7fa29b1f514059b25f4af6ecb3179d714c9a b160955d70263df0b9c47ef003736d1f286518e99b86d5ab805a6e82 12:rlfFRrEgmfR16F26DrEgmfV1qjNlYfOo4Nlc89o68:rlGwGYNljo4Nlc8o 无匹配搜索相关分析 18[1].jpg 文件名相关文件文件大小 18[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\18[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal c47fd0ba0dc76a0ace10bb9bcc8b ed781c5e4623c015baa5bc4cee3bc2497b 9ea1af40e6a3d5b264feb3a867c28d8dde9b12e fd668df24cbede314 51bc52d51d212c c07f5caab22c d0b07d86757e33128fd4d55eb4d8d8f26d8b0fd1164fb68db3d aacfce9b0d518508ceeb52 384:WVUKJZdpx1mO/vqVK4F+R8Vs4Q9N+O8/FbXxpRMsaRgGuoMZ0SRhJdM38mbuC0jy:WVUoDH1mtVX08LQ9N+O8/5KsaCGuVZ07 无匹配搜索相关分析

48 index.dat 文件名相关文件文件大小 index.dat C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist \index.dat bytes 文件类型 Internet Explorer cache file version Ver 5.2 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 3e5f0de511dcd2a20621c29c5444e c9058d64599e5b366bd622ea1e9e0062c1587 f52fb3a1184a2745e757bee18f247ff04d4429bc60ef14da2491f4e31abd0aeb 34aaf0165e8f9f8efe15ae26fa640246ca75b734eb2e6decf8787c08632f24404b88148b7dbe574a977de1117b2b7378aa2e a5db27bf67ef a1 6:qjyxXKK773IqP3FNjsdWltc3I8XFNjsdWlr:qjRK773I4JsdWlm3I8VJsdWl 无匹配搜索相关分析 12[1].png 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 12[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\12[1].png bytes JPEG image data, EXIF standard ec9af3b3e177b1e9569d564ffa82e304 ea92da2f85813b251b5f9b35741bf8b955dd871c e0aa4ad0b091a8d8bfae3ef830319b1d305d52382eb6b68da28ab2c2ed04fe60 fb27712c406d620693cb90ce67f473e ea c9e78506fad43197c7d41117d437fa5d21785de6e498b5f896f3870fe6c9263ef11b09d3948a39ae3 6144:yu8XUAFWWLyI3pX3vgKFrk2GLam44z9XXhfTfvHdJlVGSG/SI1q:yJXUAsAyO3pk2GIChfxJRGD1q 无匹配搜索相关分析 icon_7[1].gif 文件名相关文件文件大小 icon_7[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\icon_7[1].gif 922 bytes 文件类型 GIF image data, version 89a, 48 x 12 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 9de534651b271bbcd7764a598a4ce1ec 33d66fa265ed9c90bee2c9edd1f964e2bdad90f bab574f068e6aa01f126ca4a067c4000d3ed9102cce5ed4c0be3c6fddc2 1a780bf4ca959647aa f0cfb8094f59b9084a27489a0f7d56e9d6d16840d382b9eaa68914de209b3bee92bc25ddfa58db2b566461fdb562bea0fe :v/xF/4h31OZSoIzmjrnlFIwzA/9oSI639DHGIKTiJIu63z:vZFyF52QwzGW76ZHfKTRX 无匹配搜索相关分析 2[1].jpg 文件名相关文件文件大小 2[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\2[1].jpg 2184 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 344f552e4eec3ad3cc1611e37356a264 5dbaf398d39f16115bb19ad35503dd4bc2ac5b c992bbcf273dacf30912a30c dbecfda83f73aa5a8f27f3b27b1d 5549dd9075b40d f382d8b038d714c6b7b4e71bf0503fd23b8c17cf20bb569e6220de eb62a9e1f56db2749a64d114495dcf3348b6655ac4031a 48:xwhEq/Oyw3yFwUFq28DWYW3cGn8u3TokEJ+pzWtV:qS8Oy/Fwm6aYWP8Eok9pStV 无匹配搜索相关分析 RecoveryStore.{ B3A2-11E F29A}.dat 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 RecoveryStore.{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ B3A2-11E F29A}.dat 3584 bytes Composite Document File V2 Document, No summary info 854a4194b0a9002c97b3df2f912b1be2 a5b6f75003b620f7fa4440c091d73827bca42ece e5ff51805fa82435f eb4f1d0cd9fa18ad1a75101bdb1fcdcf09b73 a7cbf97d26199c9afcd7dcb28681d62df8fd0f19d511b99b d970ab6ad7a2710cb43b2664be8423ebc5c9530a481ae7b743c1db2eff7dc9f2c7e56fcc

49 Ssdeep Yara VirusTotal 12:rl0YmGF2aYrEg5+IaCrI017+FWf6DrEgmf+IaCy8qgQNlTqoE8:rIJ5/D2Gv/TQNlWod 无匹配搜索相关分析 7[1].jpg 文件名相关文件文件大小 7[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\7[1].jpg 1712 bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal 1b863c472d262ca2f075f61911e dc9954b396e8f7558c8cda9bd14330dcbc47a59 7a3656b54ad8f154700f03cc78629ca919c b6f3ff9cd1812fbf861 ad9d2efe79d713ccbd41eb0a13a77143aa5ceb6a087d f98c2bcb46b5e79a81a6d79e5391c2c3e44c7860c3065abe69ef97071b21fdd1cb58a0d5d39de 24:xQQOWsKTdLYjCK85bufaDg86aW6PjxuSSdZBaUfFAacKVwEQnQHbHcdhrfLrnl:xFO5KTdLdbufunRlrOBVfQkcddx 无匹配搜索相关分析 [1].js 文件名相关文件文件大小文件类型 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal [1].js C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\ [1].js 1967 bytes HTML document, ASCII text, with very long lines, with CRLF line terminators a50412ae62bc398d5f10d3fb94a5937f d7926cb61e7f1fee8702fe6ff25fd6a29a3a6215 a95578b81477e02bd72037e059e5bff13da148b3e4f6de6e6ebc53a2edcaf593 c3472b7e3668be0c1103e6f9827e7ef099284d0bfec889e fae5a02bdb9c2bb6fb01786bf3e322aa9604eaee886b426b708feced0b82e03a2bc1ed 48:bv5VEXjZXSoOuLLI2KuXh2ZxaG7rZWb+UhggV5hzbir:bv5VEXjZXr1LLILIh2kcrYbbJhPir 无匹配搜索相关分析 16[1].jpg 文件名相关文件文件大小 16[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\16[1].jpg bytes 文件类型 JPEG image data, JFIF standard 1.01 MD5 SHA1 SHA256 SHA512 Ssdeep Yara VirusTotal ac5c8a96399eca0da4a6a502c6999f75 0d5c46b4f0ca14a6387c43188c f cbf7dbfc7d6a a29a0cad56ec5bfeaaf16ae4c822bd8380a47a42e8b 8b0e4e6813c22d070eda1e2d31c53ea df5a9a22dd89d7f07f396b9ab8bd89dcb0c40cc39b1f21e786470b6d83fa4f937aa4be148e e :ZcSCJ0j/0yDv5mm1B6Fa4vqOdzbNd79Fh0eiEgsMH8:iSCJ0j7Dv5X1ebqONbNd7n+T8 无匹配搜索相关分析行为分析互斥量 (Mutexes) IESQMMUTEX_0_208 Local\ZonesCounterMutex Local\MSCTF.Asm.MutexDefault1 Local\!IETld!Mutex Local\c:!users!test!appdata!local!microsoft!feeds cache! Local\ZoneAttributeCacheCounterMutex Local\ZonesCacheCounterMutex Local\ZonesLockedCacheCounterMutex Local\!BrowserEmulation!SharedMemory!Mutex Local\!IECompat!Mutex Local\c:!users!test!appdata!roaming!microsoft!windows!iecompatcache! ConnHashTable<1624>_HashTable_Mutex Local\WininetStartupMutex Global\ARM Update Mutex Global\Acro Update Mutex Groove:PathMutex:huJZ0a1oPtB4yGzDQW9lw0niEfg= Groove.Mutex.WebServices.Status Groove.Mutex.SystemServices.Lock Groove:PathMutex:v1n9odwmzLTGaaFW7PZysBRMqq8= SmartScreen_UrsCacheMutex_2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2High_S Local\c:!users!test!appdata!roaming!microsoft!windows!privacie! MSIMGSIZECacheMutex Local\c:!users!test!appdata!roaming!microsoft!windows!ietldcache! _!SHMSFTHISTORY!_ Local\c:!users!test!appdata!local!microsoft!windows!history!history.ie5!mshist ! 执行的命令无信息

50 创建的服务无信息启动的服务无信息进程 iexplore.exe PID: 1624, 上一级进程 PID: 2556 iexplore.exe PID: 580, 上一级进程 PID: 1624 访问的文件 C:\Program Files (x86)\internet Explorer\ieproxy.dll C:\Windows\Fonts\staticcache.dat C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ B3A2-11E F29A}.dat C:\Windows\System32\url.dll C:\Users\test\AppData\Local\Temp\~DF6DD7D6A7BF TMP C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Temp\~DF4F77986F1C5ACD1B.TMP C:\Windows\SysWOW64\ieframe.dll C:\Windows\SysWOW64\stdole2.tlb C:\ C:\Users C:\Users\test\AppData\Local\Microsoft\Windows\Caches C:\Users\test\AppData\Local\Microsoft\Windows\Caches\cversions.1.db C:\Users\test\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x db C:\Users\desktop.ini C:\Users\test C:\Users\test\Favorites C:\Users\test\Favorites\desktop.ini C:\Users\test\Desktop\desktop.ini C:\Windows\SysWOW64\propsys.dll C:\Windows\sysnative\propsys.dll C:\Users\test\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat C:\Users\test\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico C:\Program Files (x86)\internet Explorer\url.dll C:\Users\test\Desktop\url.dll \??\MountPointManager \Device\KsecDD C:\Windows\Globalization\Sorting\sortdefault.nls C:\Program Files (x86)\internet Explorer\IEShims.dll C:\Windows\SysWOW64\shell32.dll C:\Program Files (x86)\internet Explorer\sqmapi.dll C:\Users\test\AppData\Local\Microsoft\Feeds Cache\ C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat C:\Users\test\AppData\Local\Microsoft\Feeds Cache\desktop.ini \??\Nsi C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\ C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat C:\Program Files (x86)\common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll C:\Program Files (x86)\common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll C:\Program Files (x86)\microsoft Office\Office14\GROOVEEX.DLL C:\Windows\AppPatch\sysmain.sdb C:\Program Files (x86)\microsoft Office\Office14\ C:\Program Files (x86) C:\Program Files (x86)\microsoft Office C:\Program Files (x86)\microsoft Office\Office14 C:\Program Files (x86)\microsoft Office\Office14\*.* C:\ProgramData C:\Users\test\AppData\Local C:\Users\test\AppData\Local\microsoft\Office\Groove\User\GFSConfig.xml C:\Users\test\AppData\Local\microsoft\Office\Groove\User\UnreadMarks.xml C:\Program Files (x86)\java\jre1.8.0_101\bin\ssv.dll C:\Program Files (x86)\microsoft Office\Office14\GROOVE.EXE C:\Program Files (x86)\microsoft Office\Office14\URLREDIR.DLL C:\Program Files (x86)\java\jre1.8.0_101\bin\jp2ssv.dll C:\Program Files (x86)\java C:\Program Files (x86)\java\jre1.8.0_101\bin C:\Program Files (x86)\java\jre1.8.0_101\bin\msvcr100.dll C:\Program Files (x86)\java\jre1.8.0_101\bin\deploy.dll C:\Program Files (x86)\java\jre1.8.0_101\lib\plugin.jar C:\Program Files (x86)\java\jre1.8.0_101\bin\javaws.exe C:\Users\test\AppData\Local\Temp\JavaDeployReg.log C:\Program Files (x86)\java\jre1.8.0_101 C:\Program Files (x86)\java\jre1.8.0_101\bin\java.exe C:\Program Files (x86)\java\jre1.8.0_101\bin\client\jvm.dll C:\Program Files (x86)\java\jre1.8.0_101\bin\server\jvm.dll C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\wbmfp_com[1].htm C:\Windows\WindowsShell.manifest C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\ C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat C:\Windows\sysnative\C_1256.NLS C:\Windows\sysnative\C_864.NLS C:\Windows\sysnative\C_708.NLS C:\Windows\sysnative\C_720.NLS C:\Windows\sysnative\C_28596.NLS C:\Windows\sysnative\C_10004.NLS C:\Windows\sysnative\C_1257.NLS C:\Windows\sysnative\C_775.NLS C:\Windows\sysnative\C_28594.NLS C:\Windows\sysnative\C_1250.NLS C:\Windows\sysnative\C_852.NLS C:\Windows\sysnative\C_28592.NLS C:\Windows\sysnative\C_10029.NLS C:\Windows\sysnative\C_G18030.DLL C:\Windows\sysnative\C_20936.NLS C:\Windows\sysnative\C_IS2022.DLL C:\Windows\sysnative\C_10008.NLS C:\Windows\sysnative\C_950.NLS C:\Windows\sysnative\C_20000.NLS C:\Windows\sysnative\C_20002.NLS C:\Windows\sysnative\C_10002.NLS C:\Windows\sysnative\C_10082.NLS C:\Windows\sysnative\C_1251.NLS C:\Windows\sysnative\C_866.NLS C:\Windows\sysnative\C_28595.NLS C:\Windows\sysnative\C_20866.NLS

51 C:\Windows\sysnative\C_21866.NLS C:\Windows\sysnative\C_10007.NLS C:\Windows\sysnative\c_28603.nls C:\Windows\sysnative\C_21027.NLS C:\Windows\sysnative\C_863.NLS C:\Windows\sysnative\C_20106.NLS C:\Windows\sysnative\C_1253.NLS C:\Windows\sysnative\C_737.NLS C:\Windows\sysnative\C_28597.NLS C:\Windows\sysnative\C_10006.NLS C:\Windows\sysnative\C_869.NLS C:\Windows\sysnative\C_1255.NLS C:\Windows\sysnative\C_862.NLS C:\Windows\sysnative\C_28598.NLS C:\Windows\sysnative\C_10005.NLS C:\Windows\sysnative\C_20003.NLS C:\Windows\sysnative\C_20420.NLS C:\Windows\sysnative\C_20880.NLS C:\Windows\sysnative\C_21025.NLS C:\Windows\sysnative\C_20277.NLS C:\Windows\sysnative\C_1142.NLS C:\Windows\sysnative\C_20278.NLS C:\Windows\sysnative\C_1143.NLS C:\Windows\sysnative\C_20297.NLS C:\Windows\sysnative\C_1147.NLS C:\Windows\sysnative\C_20273.NLS C:\Windows\sysnative\C_1141.NLS C:\Windows\sysnative\C_20423.NLS C:\Windows\sysnative\C_875.NLS C:\Windows\sysnative\C_20424.NLS C:\Windows\sysnative\C_20871.NLS C:\Windows\sysnative\C_1149.NLS C:\Windows\sysnative\C_500.NLS C:\Windows\sysnative\C_1148.NLS C:\Windows\sysnative\C_20280.NLS C:\Windows\sysnative\C_1144.NLS C:\Windows\sysnative\C_932.NLS C:\Windows\sysnative\C_20290.NLS C:\Windows\sysnative\C_949.NLS C:\Windows\sysnative\C_20833.NLS C:\Windows\sysnative\C_870.NLS C:\Windows\sysnative\C_20284.NLS C:\Windows\sysnative\C_1145.NLS C:\Windows\sysnative\C_874.NLS C:\Windows\sysnative\C_20838.NLS C:\Windows\sysnative\C_1254.NLS C:\Windows\sysnative\C_20905.NLS C:\Windows\sysnative\C_1026.NLS C:\Windows\sysnative\C_20285.NLS C:\Windows\sysnative\C_1146.NLS C:\Windows\sysnative\C_037.NLS C:\Windows\sysnative\C_1140.NLS C:\Windows\sysnative\C_1047.NLS C:\Windows\sysnative\C_20924.NLS C:\Windows\sysnative\C_861.NLS C:\Windows\sysnative\C_10079.NLS C:\Windows\sysnative\C_ISCII.DLL C:\Windows\sysnative\C_20269.NLS C:\Windows\sysnative\C_20932.NLS C:\Windows\sysnative\C_10001.NLS C:\Windows\sysnative\C_20949.NLS C:\Windows\sysnative\C_1361.NLS C:\Windows\sysnative\C_10003.NLS C:\Windows\sysnative\C_28593.NLS C:\Windows\sysnative\C_28605.NLS C:\Windows\sysnative\C_865.NLS C:\Windows\sysnative\C_20108.NLS C:\Windows\sysnative\C_855.NLS C:\Windows\sysnative\C_437.NLS C:\Windows\sysnative\C_858.NLS C:\Windows\sysnative\C_860.NLS C:\Windows\sysnative\C_10010.NLS C:\Windows\sysnative\C_20107.NLS C:\Windows\sysnative\C_20261.NLS C:\Windows\sysnative\C_20001.NLS C:\Windows\sysnative\C_20004.NLS C:\Windows\sysnative\C_10021.NLS C:\Windows\sysnative\C_857.NLS C:\Windows\sysnative\C_28599.NLS C:\Windows\sysnative\C_10081.NLS C:\Windows\sysnative\C_10017.NLS C:\Windows\sysnative\C_1258.NLS C:\Windows\sysnative\C_20005.NLS C:\Windows\sysnative\C_850.NLS C:\Windows\sysnative\C_20105.NLS C:\Windows\sysnative\C_28591.NLS C:\Windows\sysnative\C_10000.NLS C:\Windows\System32\en-US\MLANG.dll.mui C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\common_ec85305[1].css C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE\ C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\fi000001[1].css C:\Users\test\AppData\Local\Microsoft C:\Users\test\AppData\Local\Microsoft\Internet Explorer C:\Users\test\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\0[1].png C:\Program Files (x86)\internet Explorer\iexplore.exe.Local\ C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_ _none_72d18a c80 C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_ _none_72d18a c80\GdiPlus.dll C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\44[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\1[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\11[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\13[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\2[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\12[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\14[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\3[1].jpg

52 C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\15[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\19[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\4[1].jpg C:\Users\test\AppData\Roaming\Microsoft\Windows\IETldCache\ C:\Users\test\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\6[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\7[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\5[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\ [1].js C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\16[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\17[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\8[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\18[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\10[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\9[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\icon_7[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\go[1].htm C:\Users\test\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\test\AppData C:\Users\test\AppData\Local\Microsoft\Windows C:\Users\test\AppData\Local\Microsoft\Windows\History C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist \ C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist \index.dat C:\Windows\System32\shell32.dll 读取的文件 C:\Program Files (x86)\internet Explorer\ieproxy.dll C:\Windows\Fonts\staticcache.dat C:\Windows\System32\url.dll C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Temp\~DF6DD7D6A7BF TMP C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Temp\~DF4F77986F1C5ACD1B.TMP C:\Windows\SysWOW64\ieframe.dll C:\Windows\SysWOW64\stdole2.tlb C:\ C:\Users\test\AppData\Local\Microsoft\Windows\Caches\cversions.1.db C:\Users\test\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x db C:\Users\desktop.ini C:\Users C:\Users\test C:\Users\test\Favorites\desktop.ini C:\Users\test\Desktop\desktop.ini C:\Users\test\AppData\Local\Microsoft\Internet Explorer\frameiconcache.dat C:\Users\test\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D f-A0FF-E1416B8B2E3A}.ico \Device\KsecDD C:\Windows\Globalization\Sorting\sortdefault.nls C:\Program Files (x86)\internet Explorer\IEShims.dll C:\Windows\SysWOW64\shell32.dll C:\Program Files (x86)\internet Explorer\sqmapi.dll C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat C:\Program Files (x86)\common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll C:\Program Files (x86)\common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll C:\Program Files (x86)\microsoft Office\Office14\GROOVEEX.DLL C:\Windows\AppPatch\sysmain.sdb C:\Program Files (x86)\microsoft Office\Office14\ C:\Program Files (x86)\java\jre1.8.0_101\bin\ssv.dll C:\Program Files (x86)\microsoft Office\Office14\URLREDIR.DLL C:\Program Files (x86)\java\jre1.8.0_101\bin\jp2ssv.dll C:\Program Files (x86)\java\jre1.8.0_101\bin\msvcr100.dll C:\Program Files (x86)\java\jre1.8.0_101\bin\deploy.dll C:\Users\test\AppData\Local\Temp\JavaDeployReg.log C:\Windows\WindowsShell.manifest C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat C:\Windows\System32\en-US\MLANG.dll.mui C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\wbmfp_com[1].htm C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\common_ec85305[1].css C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\fi000001[1].css C:\Users\test\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_ _none_72d18a c80\GdiPlus.dll C:\Users\test\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\ [1].js C:\Users\test\AppData C:\Users\test\AppData\Local C:\Users\test\AppData\Local\Microsoft C:\Users\test\AppData\Local\Microsoft\Windows C:\Users\test\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist \index.dat C:\Windows\System32\shell32.dll 修改的文件 C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Temp\~DF6DD7D6A7BF TMP C:\Users\test\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{ B3A2-11E F29A}.dat C:\Users\test\AppData\Local\Temp\~DF4F77986F1C5ACD1B.TMP C:\Users\test\AppData\Local\Microsoft\Feeds Cache\index.dat C:\Users\test\AppData\Roaming\Microsoft\Windows\IECompatCache\index.dat C:\Users\test\AppData\Local\Temp\JavaDeployReg.log C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\wbmfp_com[1].htm C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\common_ec85305[1].css C:\Users\test\AppData\Roaming\Microsoft\Windows\PrivacIE\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\fi000001[1].css C:\Users\test\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\0[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\44[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\1[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\11[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\13[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\2[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\12[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\14[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\3[1].jpg

53 C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\15[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\19[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\4[1].jpg C:\Users\test\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\6[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\7[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\5[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\ [1].js C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\16[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\17[1].png C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGQJCUPQ\8[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\18[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7TAGI4AC\10[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\9[1].jpg C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30ADSMJH\icon_7[1].gif C:\Users\test\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PAPBQ2GR\go[1].htm C:\Users\test\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist \index.dat 删除的文件无信息注册表键 HKEY_CURRENT_USER\Software\Classes HKEY_CURRENT_USER\Software\Classes\Interface\{1AC7516E-E6BB-4A69-B63F-E841904DC5A6} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AC7516E-E6BB-4A69-B63F-E841904DC5A6}\ProxyStubClsid32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AC7516E-E6BB-4A69-B63F-E841904DC5A6}\ProxyStubClsid32\(Default) HKEY_CURRENT_USER\Software\Classes\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\TreatAs HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\Progid HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\Progid HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\(Default) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InprocServer32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InProcServer32\InprocServer32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InProcServer32\(Default) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InProcServer32\ThreadingModel HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InprocHandler32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A1A F-41E0-BF75-E4FDDD701CBA}\InprocHandler HKEY_CURRENT_USER\Software\Classes\Interface\{7673B35E-907A-449D-A49F-E5CE47F0B0B2} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7673B35E-907A-449D-A49F-E5CE47F0B0B2}\ProxyStubClsid32 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7673B35E-907A-449D-A49F-E5CE47F0B0B2}\ProxyStubClsid32\(Default) HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing\Groups HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\TabbedBrowsing HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\WindowsSearch HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\WindowsSearch\EnabledScopes HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Feeds HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Feeds HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Feeds HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Search HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Search\CurrentVersion HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\ HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\a HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\\xe5\xbe\xae\xe8\xbd\xaf\xe9\x9b\x85\xe9\xbb\x91 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Security\DisableFixSecuritySettings HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableFixSecuritySettings HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security\DisableFixSecuritySettings HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Toolbar\WebBrowser HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Position HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FullScreen HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\IEAK HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\IEAK

展开

魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :26: :28: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 K

魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :26: :28: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 K 魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL 2016-11-21 19:26:26 2016-11-21 19:28:41 135 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 KVM 2016-11-21 19:26:26 2016-11-21 19:28:41 魔盾分数 1.05

魔盾安全分析报告 分析类型 开始时间 结束时间 持续时间 分析引擎版本 URL :34: :37: 秒 1.4-Maldun 虚拟机机器名 标签 虚拟机管理 开机时间 关机时间 win7-sp1-x64 win7-sp1-x64 K

魔盾安全分析报告分析类型开始时间结束时间持续时间分析引擎版本 URL :34: :37: 秒 1.4-Maldun 虚拟机机器名标签虚拟机管理开机时间关机时间 win7-sp1-x64 win7-sp1-x64 K