CF炸房目前win7不支持_CF穿越火线

ZxID：18230900

等级: 上将

举报只看楼主使用道具楼主发表于: 2016-04-25 0

CF炸房器目前win7不支持 win8 10要以管理员运行，不然获取不到房间IP，
要想炸先去四川1-2区测试能吗？其他区自测！火眼查毒http://fireeye.ijinshan.com/analyse.html?md5=8cdc8dea7d0cb6684bd2693539242863&sha1=147e34c7d743aeb22c89a07423320b0cfaac22c1&type=1

猴岛_se.rar[点击下载](3448 K) 下载次数:40 累计下载获得ＤＢ 68 刀

[ 此帖被7★太子哥在2016-04-25 19:17重新编辑 ]

本帖de评分：共 2 条评分ＤＢ +5

额，螺师	ＤＢ⁺¹	2016-04-25	病毒在线分析可疑，谨慎下载：https://habo.qq.com/file/showdetail?pk=ADQGb11oB28IMFs7#other
null	ＤＢ⁺⁴	2016-04-25	谢谢你的分析猴岛有你更精彩

隐藏

打赏收藏新鲜事

回复引用

鲜花[0]　

鸡蛋[0]

额，螺师

ZxID：65737028

等级: 禁止发言

配偶: 20116558Yy

举报只看该作者 14楼发表于: 2016-04-25 0

https://habo.qq.com/file/showdetail?pk=ADQGb11oB28IMFs7#other

行为描述：	跨进程写入数据
详情信息：	TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cip.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cip.exe, WriteAddress = 0x00020000, Size = 0x00000738 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cip.exe, WriteAddress = 0x7ffde010, Size = 0x00000004 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\cip.exe, WriteAddress = 0x7ffde1e8, Size = 0x00000004 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ldyz.exe, WriteAddress = 0x00010000, Size = 0x000007c2 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ldyz.exe, WriteAddress = 0x00020000, Size = 0x0000073c TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ldyz.exe, WriteAddress = 0x7ffde010, Size = 0x00000004 TargetProcess = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ldyz.exe, WriteAddress = 0x7ffde1e8, Size = 0x00000004
行为描述：	探测 Virtual PC是否存在
详情信息：	N/A
行为描述：	尝试打开调试器或监控软件的驱动设备对象
详情信息：	\??\SICE \??\SIWVID \??\NTICE
行为描述：	获取TickCount值
详情信息：	TickCount = 496003, SleepMilliseconds = 50. TickCount = 497440, SleepMilliseconds = 50. TickCount = 497956, SleepMilliseconds = 50. TickCount = 498315, SleepMilliseconds = 50. TickCount = 498331, SleepMilliseconds = 50. TickCount = 498362, SleepMilliseconds = 50. TickCount = 498378, SleepMilliseconds = 50. TickCount = 498409, SleepMilliseconds = 50. TickCount = 498518, SleepMilliseconds = 50. TickCount = 498550, SleepMilliseconds = 50. TickCount = 499612, SleepMilliseconds = 50. TickCount = 499737, SleepMilliseconds = 50. TickCount = 499753, SleepMilliseconds = 50. TickCount = 499831, SleepMilliseconds = 50. TickCount = 499862, SleepMilliseconds = 50.
行为描述：	获取窗口截图信息
详情信息：	Foreground window Info: HWND = 0x00000000, DC = 0x410104a4. Foreground window Info: HWND = 0x00000000, DC = 0x85010205. Foreground window Info: HWND = 0x00000000, DC = 0x0401048a. Foreground window Info: HWND = 0x00000000, DC = 0x190102e8. Foreground window Info: HWND = 0x00000000, DC = 0xd5010437. Foreground window Info: HWND = 0x00000000, DC = 0x910102c9.
行为描述：	查询注册表_检测虚拟机相关
详情信息：	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
行为描述：	查找指定内核模块
详情信息：	ntkrnlpa.exe Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动 hal.dll Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动 KDCOM.DLL Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动 BOOTVID.dll Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动 ACPI.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动 WMILIB.SYS Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动 pci.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动 isapnp.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动 compbatt.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动 BATTC.SYS Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动 intelide.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动 PCIIDEX.SYS Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动 MountMgr.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动 ftdisk.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动 dmload.sys Des: SoftICE驱动" style="padding: 0px; overflow: hidden; white-space: nowrap; text-overflow: ellipsis; width: 710px; height: 25px;">lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述：	查找反病毒常用工具窗口
详情信息：	NtUserFindWindowEx: [Class,Window] = [OLLYDBG,] NtUserFindWindowEx: [Class,Window] = [GBDYLLO,] NtUserFindWindowEx: [Class,Window] = [pediy06,] NtUserFindWindowEx: [Class,Window] = [FilemonClass,] NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com] NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,] NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com] NtUserFindWindowEx: [Class,Window] = [RegmonClass,] NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]