查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
---|---|---|---|
Alibaba | None | 20190527 | 0.3.0.5 |
Avast | Win32:Small-MHL [Trj] | 20190920 | 18.4.3895.0 |
Baidu | None | 20190318 | 1.0.0.2 |
CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
Kingsoft | None | 20190920 | 2013.8.14.323 |
McAfee | QLowZones-43 | 20190920 | 6.0.6.653 |
Tencent | None | 20190920 | 1.0.0.1 |
host | 114.114.114.114 | |||
host | 8.8.8.8 |
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger | reg_value | 0 | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Print Spooler | reg_value | C:\Windows\system32\SPOOL.EXE | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LocalSecurityAuthoritySubsystem | reg_value | C:\Windows\LSAS.EXE |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1402 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2000 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2300 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2200 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1406 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1609 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A05 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1608 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1405 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2300 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1609 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1208 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2000 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2200 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A02 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2105 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1608 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A02 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A10 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1809 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2102 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1402 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\180A |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2104 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1206 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1804 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1402 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1605 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1804 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A10 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1809 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120A |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2301 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1407 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1407 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2000 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1804 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1605 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1809 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1A05 |
ALYac | Trojan.Agent.ALKT |
APEX | Malicious |
AVG | Win32:Small-MHL [Trj] |
Acronis | suspicious |
Ad-Aware | Trojan.Agent.ALKT |
AhnLab-V3 | Trojan/Win32.Agent.C57026 |
Antiy-AVL | Trojan/Win32.Small.yag |
Arcabit | Trojan.Agent.ALKT |
Avast | Win32:Small-MHL [Trj] |
Avira | TR/ATRAPS.Gen |
BitDefender | Trojan.Agent.ALKT |
CAT-QuickHeal | Trojan.Mauvaise.SL1 |
CMC | Trojan.Win32.Small!O |
ClamAV | Win.Malware.Alkt-6915258-0 |
Comodo | TrojWare.Win32.Small.YBE@m3lz7 |
CrowdStrike | win/malicious_confidence_100% (D) |
Cybereason | malicious.d32251 |
Cylance | Unsafe |
Cyren | W32/Heuristic-257!Eldorado |
DrWeb | Trojan.LowZones.2000 |
ESET-NOD32 | a variant of Win32/Oberal.A |
Emsisoft | Trojan.Agent.ALKT (B) |
Endgame | malicious (high confidence) |
F-Prot | W32/Heuristic-257!Eldorado |
F-Secure | Trojan.TR/ATRAPS.Gen |
FireEye | Generic.mg.f4959d9d32251783 |
Fortinet | W32/Small.YBE!tr |
GData | Trojan.Agent.ALKT |
Ikarus | Trojan.Win32.Small |
Invincea | heuristic |
Jiangmin | Trojan/Small.eyw |
K7AntiVirus | Trojan ( 005450941 ) |
K7GW | Trojan ( 005450941 ) |
Kaspersky | Trojan.Win32.Small.yag |
MAX | malware (ai score=85) |
MaxSecure | Trojan.Malware.121218.susgen |
McAfee | QLowZones-43 |
McAfee-GW-Edition | BehavesLike.Win32.QLowZones.lt |
MicroWorld-eScan | Trojan.Agent.ALKT |
Microsoft | TrojanSpy:Win32/Agent.BX |
Panda | Trj/Downloader.XIA |
Qihoo-360 | HEUR/QVM20.1.0479.Malware.Gen |
Rising | Trojan.Win32.Fednu.ulk (CLASSIC) |
SentinelOne | DFI - Malicious PE |
Sophos | Troj/QLowZon-FG |
Symantec | Trojan Horse |
TACHYON | Trojan/W32.Agent.17408.QD |
Trapmine | suspicious.low.ml.score |
VBA32 | Trojan.Small |
ViRobot | Trojan.Win32.Small.17408.F |
Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
---|---|---|---|---|
.text | 0x00001000 | 0x00000d72 | 0x00000e00 | 5.606649728428857 |
.rdata | 0x00002000 | 0x000002b4 | 0x00000400 | 3.557205271669792 |
.data | 0x00003000 | 0x0000384f | 0x00002800 | 4.376183701073933 |
.rsrc | 0x00007000 | 0x00000470 | 0x00000600 | 2.05011805735382 |
Name | Offset | Size | Language | Sub-language | File type |
---|---|---|---|---|---|
RT_ICON | 0x000070f0 | 0x000002e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
RT_MENU | 0x000073f0 | 0x00000080 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
RT_GROUP_ICON | 0x000073d8 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |