>>1214938
Нихуя нет
Report generated with Buster Sandbox Analyzer 1.88 at 10:07:17 on 20/04/2015

[ General information ]
File name: G:\Temp\Sandboxed\RF_SCreater\RF_SCreater.exe
File length: 2359296 bytes
File signature (PEiD): Borland Delphi 6.0 - 7.0
File signature (Exeinfo): Borland Delphi ( 2.0 - 7.0 ) 1992 - www.borland.com
TLS hooks: NO
File entropy: 5.15673 (64.4591%)
ssdeep signature: 24576:qr7zjCAce3rjO9nBHIqQ6GYja8GFvGsanK8bp7kmwTbc:qJfWlIqQWja8GRGM
Adobe Malware Classifier: Malicious
Digital signature: Unsigned
MD5 hash: ca67b7e7cc3edc26f396e66605f261cf
SHA1 hash: 2db8aaa75f891c5ea31dbb61bcc17ea4e6efe36b

[ Changes to filesystem ]
Modifies file E:\ProgramData\NVIDIA Corporation\Drs\nvAppTimestamps
File length: 29356 bytes
File type: Unknown
MD5 hash: 8d175f9f334a39b431b8e2b96f2e64b7

[ Changes to registry ]
Creates Registry key HKEY_LOCAL_MACHINE\software\classes\ActivatableClasses\CLSID
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\SQMClient\Windows\DisabledProcesses
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\TelemetryClient\SampleStore\sqm
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{19366a42-b85e-4fea-af18-050ae3088884}\Properties
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{6ed7cb4f-4b23-4c53-933c-17b7fab30821}\Properties
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{938ba3d8-c61f-4127-8011-95f89b38cfb7}\Properties
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{dc5b55f4-da8f-43e1-9fca-5fe532eecc8c}\Properties
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\Windows nt\currentversion\appcompatflags\AIT
Creates Registry key HKEY_LOCAL_MACHINE\software\microsoft\WindowsRuntime\CLSID
Creates Registry key HKEY_LOCAL_MACHINE\software\NVIDIA Corporation\Global\NVTweak
Creates value "Name=RF_SCreater.exe" in key HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication
binary data=520046005F00530043007200650061007400650072002E006500780065000000
Creates value "ID=2A425E19" in key HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication
Modifies value "NukeOnDelete=00000001" in key HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e134d4e6-5d21-11e3-bec4-c86000c22bc1}
old value empty

[ Network services ]
No changes

[ Process/window/string information ]
Gets system default language ID.
Gets input locale identifiers.
Checks for debuggers.
Installs a hook procedure that monitors mouse messages.
Creates a mutex "Local\DirectSound DllMain mutex (0x000028C0)".
Creates a mutex "DirectSound Administrator shared thread array (lock)".
* Opens a service named "AudioSrv".