Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\Desktop\desktop.ini
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://ssp.7654.com/ct/m?mixData=
|
unknown
|
||
|
http://report.thorzip.muxin.fun/eH
|
unknown
|
||
|
http://hotnews.dftoutiao.com/
|
unknown
|
||
|
http://report.thorzip.muxin.fun/lszip/bubble_info?code=jWLGHnD6CYifDIjqc6sGs/Bbp6bCfV8bglNO
|
unknown
|
||
|
http://news.7654.com/mini_new3/jsb/
|
unknown
|
||
|
http://pv.sohu.com/cityjson?ie=utf-8
|
unknown
|
||
|
http://www.symauth.com/rpa00
|
unknown
|
||
|
http://hotnews.dftoutiao.com/hotwordsnews/getnews?qid=kuaiyatitle&platform=pc&newstype=now
|
unknown
|
||
|
http://api.map.baidu.com/telematics/v3/weather?location=%s&output=json&ak=spmMww7Eoqcmf3FXbnLyDUwLU
|
unknown
|
||
|
http://files.news.baidu.com/mini_new3/jjj/MiniLogo.PNG
|
unknown
|
||
|
http://hotnews.dftoutiao.com/hotwordsnews/getnews?qid=%s&platform=pc&newstype=%s
|
unknown
|
||
|
http://report.thorzip.muxin.fun/tart
|
unknown
|
||
|
http://weather.shzhanmeng.com/api/weather/%sU
|
unknown
|
||
|
http://api.map.baidu.com/telematics/v3/weather?location=%s&output=json&ak=spmMww7Eoqcmf3FXbnLyDUwL
|
unknown
|
||
|
http://www.symauth.com/cps0(
|
unknown
|
||
|
http://report.thorzip.muxin.fun/
|
unknown
|
||
|
http://ssp.7654.com/ct?mixData=
|
unknown
|
||
|
http://ssp.7654.com/ct?mixData=les
|
unknown
|
||
|
http://news.baidu.com/mini_new3/jjj/
|
unknown
|
||
|
http://report.thorzip.muxin.fun/crosoft
|
unknown
|
||
|
http://iplocation.7654.com/v1
|
unknown
|
||
|
http://weather.shzhanmeng.com/api/weather/%s
|
unknown
|
||
|
http://bsalsa.com/
|
unknown
|
||
|
http://report.thorzip.muxin.fun/lszip/bubble_info?code=jwlghnd6cyifdijqc6sgs/bbp6bcfv8bglno
|
unknown
|
There are 14 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
report.thorzip.muxin.fun
|
unknown
|
||
|
hotnews.dftoutiao.com
|
unknown
|
||
|
files.news.baidu.com
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
|
SecuriteInfo.com.Win32.Adware-gen.13861.28606.exe
|
||
|
HKEY_CURRENT_USER\SOFTWARE\MiniNewsInfo
|
CLS_ID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\LiveUpdate360
|
632
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
305C000
|
direct allocation
|
page read and write
|
||
|
2A4B000
|
stack
|
page read and write
|
||
|
23C3000
|
direct allocation
|
page read and write
|
||
|
4BB000
|
unkown
|
page write copy
|
||
|
604000
|
heap
|
page read and write
|
||
|
2190000
|
heap
|
page read and write
|
||
|
605000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
74E000
|
stack
|
page read and write
|
||
|
672000
|
heap
|
page read and write
|
||
|
2CCF000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
7FD40000
|
direct allocation
|
page read and write
|
||
|
65B000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2367000
|
direct allocation
|
page read and write
|
||
|
22E8000
|
direct allocation
|
page read and write
|
||
|
4CC000
|
unkown
|
page readonly
|
||
|
604000
|
heap
|
page read and write
|
||
|
23B4000
|
direct allocation
|
page read and write
|
||
|
237B000
|
direct allocation
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
4C6000
|
unkown
|
page read and write
|
||
|
19B000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
22BB000
|
direct allocation
|
page read and write
|
||
|
2304000
|
direct allocation
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
2375000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
98F000
|
stack
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
22FA000
|
direct allocation
|
page read and write
|
||
|
686000
|
heap
|
page read and write
|
||
|
21A0000
|
direct allocation
|
page execute and read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
294E000
|
stack
|
page read and write
|
||
|
2BCE000
|
stack
|
page read and write
|
||
|
3065000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
22D9000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2290000
|
heap
|
page read and write
|
||
|
4C0000
|
unkown
|
page read and write
|
||
|
22CB000
|
direct allocation
|
page read and write
|
||
|
22A0000
|
direct allocation
|
page read and write
|
||
|
232A000
|
direct allocation
|
page read and write
|
||
|
2398000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
307C000
|
direct allocation
|
page read and write
|
||
|
618000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
225C000
|
stack
|
page read and write
|
||
|
22B4000
|
direct allocation
|
page read and write
|
||
|
2382000
|
direct allocation
|
page read and write
|
||
|
68C000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
290D000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
23AD000
|
direct allocation
|
page read and write
|
||
|
239F000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2E0F000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
600000
|
heap
|
page read and write
|
||
|
23A6000
|
direct allocation
|
page read and write
|
||
|
4C4000
|
unkown
|
page read and write
|
||
|
22F2000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2E41000
|
heap
|
page read and write
|
||
|
2D0E000
|
stack
|
page read and write
|
||
|
230B000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2213000
|
heap
|
page read and write
|
||
|
30C0000
|
trusted library allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
88E000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2A8E000
|
stack
|
page read and write
|
||
|
2E40000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2390000
|
direct allocation
|
page read and write
|
||
|
231B000
|
direct allocation
|
page read and write
|
||
|
658000
|
heap
|
page read and write
|
||
|
2210000
|
heap
|
page read and write
|
||
|
2389000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
84F000
|
stack
|
page read and write
|
||
|
23D1000
|
direct allocation
|
page read and write
|
||
|
236E000
|
direct allocation
|
page read and write
|
||
|
4C6000
|
unkown
|
page write copy
|
||
|
23D8000
|
direct allocation
|
page read and write
|
||
|
30E0000
|
heap
|
page read and write
|
||
|
23CA000
|
direct allocation
|
page read and write
|
||
|
23BC000
|
direct allocation
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
4BB000
|
unkown
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2B8F000
|
stack
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
604000
|
heap
|
page read and write
|
||
|
2322000
|
direct allocation
|
page read and write
|
There are 104 hidden memdumps, click here to show them.