荒野求生透视-谁用谁知道。掉线我吃屎

御姐

高度风险
行为描述：        探测 Virtual PC是否存在
详情信息：       
N/A
行为描述：        查询注册表_检测虚拟机相关
详情信息：       
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
行为描述：        尝试打开调试器或监控软件的驱动设备对象
详情信息：       
\??\SICE
\??\SIWVID
\??\NTICE
行为描述：        杀掉进程
详情信息：       
C:\WINDOWS\system32\360tray.exe
C:\WINDOWS\system32\AST.exe
行为描述：        打开注册表_检测虚拟机相关
详情信息：       
\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__
行为描述：        创建系统服务
详情信息：       
[服务创建成功]: Abcdef Hijklmno Qrs, C:\WINDOWS\system32\oooyou.exe
行为描述：        获取TickCount值
详情信息：       
TickCount = 225050, SleepMilliseconds = 800.
TickCount = 227659, SleepMilliseconds = 50.
TickCount = 227675, SleepMilliseconds = 50.
TickCount = 227753, SleepMilliseconds = 50.
TickCount = 227768, SleepMilliseconds = 50.
TickCount = 229331, SleepMilliseconds = 50.
TickCount = 229471, SleepMilliseconds = 50.
TickCount = 229487, SleepMilliseconds = 50.
TickCount = 229534, SleepMilliseconds = 50.
TickCount = 229612, SleepMilliseconds = 50.
TickCount = 229706, SleepMilliseconds = 50.
TickCount = 229721, SleepMilliseconds = 50.
行为描述：        直接获取CPU时钟
详情信息：       
EAX = 0x17bf6930, EDX = 0x000000bb
EAX = 0x17bf697c, EDX = 0x000000bb
EAX = 0x17bf69c8, EDX = 0x000000bb
EAX = 0x17bf6a14, EDX = 0x000000bb
EAX = 0x17bf6a60, EDX = 0x000000bb
EAX = 0x17bf6aac, EDX = 0x000000bb
EAX = 0x3cb16fd9, EDX = 0x000000bb
EAX = 0x3cb17025, EDX = 0x000000bb
EAX = 0x3cb17071, EDX = 0x000000bb
EAX = 0x3cb170bd, EDX = 0x000000bb
行为描述：        查找指定内核模块
详情信息：       
lstrcmpiA: ntice.sys <------> ntkrnlpa.exe Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> hal.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> KDCOM.DLL Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BOOTVID.dll Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ACPI.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> WMILIB.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> pci.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> isapnp.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> compbatt.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> BATTC.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> intelide.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> PCIIDEX.SYS Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> MountMgr.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> ftdisk.sys Des: SoftICE驱动
lstrcmpiA: ntice.sys <------> dmload.sys Des: SoftICE驱动
行为描述：        查找反病毒常用工具窗口
详情信息：       
NtUserFindWindowEx: [Class,Window] = [OLLYDBG,]
NtUserFindWindowEx: [Class,Window] = [GBDYLLO,]
NtUserFindWindowEx: [Class,Window] = [pediy06,]
NtUserFindWindowEx: [Class,Window] = [FilemonClass,]
NtUserFindWindowEx: [Class,Window] = [,File Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [PROCMON_WINDOW_CLASS,]
NtUserFindWindowEx: [Class,Window] = [,Process Monitor - Sysinternals: www.sysinternals.com]
NtUserFindWindowEx: [Class,Window] = [RegmonClass,]
NtUserFindWindowEx: [Class,Window] = [,Registry Monitor - Sysinternals: www.sysinternals.com]
行为描述：        VMWare特殊指令检测虚拟机
详情信息：       
N/A

lihongzhe66

金币是个好东西

qq438466714

fasfasfasfas

lchen

jinbijinbi

wlq81510212

meitu美图你说个什么啊

474842163

金币是个好东西

高鹏宇

试试看吧，要是不能用，又会封号

高鹏宇

RE: 荒野求生透视-谁用谁知道。掉线我吃屎

高鹏宇

RE: 荒野求生透视-谁用谁知道。掉线我吃屎 [

高鹏宇

RE: 荒野求生透视-谁用谁知道。掉线我吃屎