文件行为
行为描述:写权限映射文件
详情信息:CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.IMI..NEIIG
MSCTF.MarshalInterface.FileMap.IMI.B.MGIIG
MSCTF.MarshalInterface.FileMap.IMI.C.MGIIG
MSCTF.MarshalInterface.FileMap.IMI.D.MGIIG
MSCTF.MarshalInterface.FileMap.IMI.E.MHIIG
MSCTF.MarshalInterface.FileMap.IMI.F.MHIIG
MSCTF.MarshalInterface.FileMap.IMI.G.MHIIG
MSCTF.Shared.SFM.IMI
MSCTF.MarshalInterface.FileMap.IKM..FFNMG
MSCTF.MarshalInterface.FileMap.IKM.B.EGNMG
MSCTF.MarshalInterface.FileMap.IKM.C.EGNMG
MSCTF.MarshalInterface.FileMap.IKM.D.EGNMG
MSCTF.MarshalInterface.FileMap.IKM.E.EGNMG
MSCTF.MarshalInterface.FileMap.IKM.F.EGNMG
行为描述:重命名文件
详情信息:C:\Program Files\Worksnaps\is-9GUNF.tmp ---> C:\Program Files\Worksnaps\unins000.exe
C:\Program Files\Worksnaps\is-R6NSQ.tmp ---> C:\Program Files\Worksnaps\AWSSDK.dll
C:\Program Files\Worksnaps\is-0J2TP.tmp ---> C:\Program Files\Worksnaps\capserv.dll
C:\Program Files\Worksnaps\is-JS41R.tmp ---> C:\Program Files\Worksnaps\captureDesktop.exe
C:\Program Files\Worksnaps\is-B93IB.tmp ---> C:\Program Files\Worksnaps\processImage.exe
C:\Program Files\Worksnaps\is-DDAI4.tmp ---> C:\Program Files\Worksnaps\procUpload.exe
C:\Program Files\Worksnaps\is-484J8.tmp ---> C:\Program Files\Worksnaps\config.ini.xml
C:\Program Files\Worksnaps\is-GL244.tmp ---> C:\Program Files\Worksnaps\noscreen.jpg
C:\Program Files\Worksnaps\is-CB6GR.tmp ---> C:\Program Files\Worksnaps\noscreen_thumb.jpg
C:\Program Files\Worksnaps\is-O5O9J.tmp ---> C:\Program Files\Worksnaps\procUploadDirect.net20.exe
C:\Program Files\Worksnaps\is-3743N.tmp ---> C:\Program Files\Worksnaps\procUploadDirect.net45.exe
C:\Program Files\Worksnaps\is-V35TG.tmp ---> C:\Program Files\Worksnaps\screen_1000.jpg
C:\Program Files\Worksnaps\is-JOOIN.tmp ---> C:\Program Files\Worksnaps\SkinH.dll
C:\Program Files\Worksnaps\is-BFE22.tmp ---> C:\Program Files\Worksnaps\skinh.she
C:\Program Files\Worksnaps\is-53Q8V.tmp ---> C:\Program Files\Worksnaps\WebCam.dll
行为描述:创建可执行文件
详情信息:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-TPN0C.tmp\sample.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\is-1P09R.tmp\_isetup\_shfoldr.dll
C:\Program Files\Worksnaps\is-9GUNF.tmp
C:\Program Files\Worksnaps\is-R6NSQ.tmp
C:\Program Files\Worksnaps\is-0J2TP.tmp
C:\Program Files\Worksnaps\is-JS41R.tmp
C:\Program Files\Worksnaps\is-B93IB.tmp
C:\Program Files\Worksnaps\is-DDAI4.tmp
C:\Program Files\Worksnaps\is-O5O9J.tmp
C:\Program Files\Worksnaps\is-3743N.tmp
C:\Program Files\Worksnaps\is-JOOIN.tmp
C:\Program Files\Worksnaps\is-53Q8V.tmp
C:\Program Files\Worksnaps\is-JR3EN.tmp
C:\Program Files\Worksnaps\is-9HLRO.tmp
C:\Program Files\Worksnaps\is-B5GE7.tmp
行为描述:修改文件内容
详情信息:C:\Program Files\Worksnaps\is-484J8.tmp---> Offset = 0
C:\Program Files\Worksnaps\is-GL244.tmp---> Offset = 0
C:\Program Files\Worksnaps\is-CB6GR.tmp---> Offset = 0
C:\Program Files\Worksnaps\is-V35TG.tmp---> Offset = 0
C:\Program Files\Worksnaps\is-BFE22.tmp---> Offset = 0
C:\Program Files\Worksnaps\res\is-0GM0N.tmp---> Offset = 0
C:\Documents and Settings\All Users\「开始」菜单\程序\Worksnaps Client\Worksnaps Client.lnk---> Offset = 0
C:\Documents and Settings\All Users\「开始」菜单\程序\Worksnaps Client\Uninstall .lnk---> Offset = 0
C:\Program Files\Worksnaps\unins000.dat---> Offset = 460
C:\Documents and Settings\Administrator\My Documents\worksnaps\config.xml---> Offset = 0
C:\Documents and Settings\Administrator\My Documents\worksnaps\screenrecord_trace.log---> Offset = 0
C:\Documents and Settings\Administrator\My Documents\worksnaps\screenrecord_trace.log---> Offset = 256
行为描述:在系统敏感位置(如开始菜单等)释放链接或快捷方式
详情信息:C:\Documents and Settings\All Users\「开始」菜单\程序\Worksnaps Client\Worksnaps Client.lnk
C:\Documents and Settings\All Users\「开始」菜单\程序\Worksnaps Client\Uninstall .lnk