Play interactive tourEdit tour

Windows Analysis Report
http://api.pdfxd.com/pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700

Overview

General Information

Sample URL:	http://api.pdfxd.com/pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700
Analysis ID:	763918
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to infect the boot sector

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Drops files with a non-matching file extension (content does not match file extension)

AV process strings found (often used to terminate AV products)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Found evasive API chain checking for process token information

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains capabilities to detect virtual machines

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to query network adapater information

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsIeView.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsWebView.pdb; source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, LdsWebView.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgr.pdb$p source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\347776\out\Release\MiniNews.pdb source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgrStub.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2377952920.000000006E687000.00000002.00000001.01000000.0000000E.sdmp, PopMgrStub.dll.13.dr
Source:	Binary string: D:\build\lib_common\basic\Release\Basic.pdb source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, Basic.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsWebView.pdb source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, LdsWebView.dll.13.dr
Source:	Binary string: d:\build\360cloud_build\360NetUL_base1031\bin\360NetUL.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2189831952.0000000002EE3000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2246706121.0000000003D01000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2371078507.000000006E3FB000.00000002.00000001.01000000.00000010.sdmp, 360NetUL.dll.13.dr
Source:	Binary string: c:\code\android\donut\development\host\windows\usb\winusb\objfre_wxp_x86\i386\AdbWinUsbApi.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MasterPDF.exe.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgrStub.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2377952920.000000006E687000.00000002.00000001.01000000.0000000E.sdmp, PopMgrStub.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgr.pdb source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\342920\out\Release\Basic.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr
Source:	Binary string: E:\build\360BaseNew\360Base\Release\360Base.pdb source: 7zG.exe, 0000000D.00000003.1816096554.0000028C791DF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2381037827.000000006E781000.00000002.00000001.01000000.0000000C.sdmp, 360Base.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\376264\out\Release\DisPatchMini.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp, DisPatchMini.dll.13.dr

Spreading

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E534898 FindFirstFileExA,

14_2_6E534898

Networking

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Connects to IPs without corresponding DNS lookups

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

URLs found in memory or binary data

Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/cps.html0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ac.economia.gob.mx/last.crl0G
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354795443.0000000002F0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acedicom.edicomgroup.com/doc0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: MiniNews.exe, 0000000E.00000003.2208915686.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210529606.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: MiniNews.exe	String found in binary or memory: http://cdn-ali.mikannovel.com/cms/project_40/cfg_center/mod_list.js
Source: MiniNews.exe	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_16/cfg_center/mod_list.js
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_16/cfg_center/mod_list.jshttp://cdn-file.ludashi.com/cms/pro
Source: MiniNews.exe	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_20/cfg_center/mod_list.js
Source: MiniNews.exe	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_21/cfg_center/mod_list.js
Source: MiniNews.exe	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_24/cfg_center/mod_list.js
Source: MiniNews.exe	String found in binary or memory: http://cdn-file.ludashi.com/cms/project_40/cfg_center/mod_list.js
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210791788.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210791788.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: MiniNews.exe, 0000000E.00000003.2206664742.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354385528.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: MiniNews.exe, 0000000E.00000003.2206664742.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354385528.0000000002EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.oces.trust2408.com/oces.crl0
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-a/cacrl.crl0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.ssc.lt/root-c/cacrl.crl0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2211501552.00000000049F2000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2217196525.00000000049F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: MiniNews.exe, 0000000E.00000002.2346396895.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.14.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: MiniNews.exe, 0000000E.00000003.2206664742.0000000002EC9000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2206073299.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2218236306.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354866032.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?26224964c324a
Source: MiniNews.exe, 0000000E.00000003.2206073299.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2218236306.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabjD6G
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	String found in binary or memory: http://dl.ludashi.com/ludashi/ludashisetup.exeChengdu
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/CRL2/CA.crl0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://eca.hinet.net/repository/Certs/IssuedToThisCA.p7b05
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2213934739.0000000004B3A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208172720.0000000004B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.ludashi.com/cfg/bizhi_detail.php
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.ludashi.com/cfg/coupon_detail.php
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.ludashi.com/cfg/detail.php
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.ludashi.com/cfg/mgame_detail.php
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.ludashi.com/cfg/xiaolu_detail.php
Source: MiniNews.exe	String found in binary or memory: http://intf-pc.mikannovel.com/cfg/detail.php
Source: MiniNews.exe	String found in binary or memory: http://l.public.fireemulator.com/pc/updata/dump
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	String found in binary or memory: http://l.public.ludashi.com/pc/feedback/miniPage.jpgimage/jpegimage/
Source: MiniNews.exe	String found in binary or memory: http://l.public.ludashi.com/pc/updata/dump
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	String found in binary or memory: http://l3.public.ludashi.com/pc/feedback/cheat
Source: MiniNews.exe, 0000000E.00000002.2346396895.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2368204936.0000000004A3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://max-l.mediav.com/rtb?type=2&v=CGQSEDE2YzRhYzRjYWRjOWQxYzIYq7uJASD4pkYoAUACSKEZYhcxOTIzODM0NTA
Source: MiniNews.exe, 0000000E.00000002.2370099807.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2369315666.0000000004AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://max-l.mediav.com/rtb?type=3&v=CGQSEDE2YzRhYzRjYWRjOWQxYzIYq7uJASD4pkYoAUACSKEZYhcxOTIzODM0NTA
Source: MiniNews.exe, 0000000E.00000002.2370099807.0000000004E9A000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354573894.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://max-l.mediav.com/rtb?type=4&impargs=
Source: MiniNews.exe, 0000000E.00000002.2353918046.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://media.ludashi.com/n/mini/add?token=14622532903991f4483ae4d15ab2cc2f&screentype=22
Source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp, DisPatchMini.dll.13.dr	String found in binary or memory: http://media.ludashi.com/n/mini?pid=%s&appver=%s&modver=%s&from=%s&iever=%s&os=%s&mid=%s&mid2=%s&man
Source: MiniNews.exe, 0000000E.00000002.2368138541.0000000004A11000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354866032.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://media.ludashi.com/n/mini?pid=&appver=2.0.0.1010&modver=1.5019.1030.826&from=xundu&iever=ie11&
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.eca.hinet.net/OCSP/ocspG2sha20
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.ncdc.gov.sa0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.gva.es0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.suscerte.gob.ve0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.digidentity.eu/validatie0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s.fireemulator.com/apkmagicemu?pid=
Source: MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.ludashi.com/
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s.ludashi.com/ownloads
Source: MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.ludashi.com/s
Source: MiniNews.exe.13.dr	String found in binary or memory: http://s.ludashi.com/url2?pid=
Source: MiniNews.exe.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s.ludashi.com/url3?pid=
Source: MiniNews.exe.13.dr	String found in binary or memory: http://s.ludashi.com/url4?pid=
Source: MiniNews.exe, 0000000F.00000003.2249061393.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.ludashi.com/url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s.symcd.com06
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://s2.symcb.com0
Source: MiniNews.exe, 0000000E.00000002.2368732115.0000000004A7C000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2349225911.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s3m7.nzwgs.com/galileo/5c9919dedc9dd7031187f2b3e7eaa4c4.png
Source: MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s3m7.nzwgs.com/galileo/5c9919dedc9dd7031187f2b3e7eaa4c4.png:
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	String found in binary or memory: http://show.g.mediav.com/s?type=1&of=4&newf=2&showids=
Source: MiniNews.exe, 0000000E.00000002.2349043223.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://show.g.mediav.com/s?type=1&of=4&newf=2&showids=Kf4chm&mid=
Source: MiniNews.exe, 0000000E.00000002.2348768192.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2354866032.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://show.g.mediav.com/s?type=1&of=4&newf=2&showids=Kf4chm&mid=0ee28fbdc66209b6fd4684a055d0db85&ui
Source: MiniNews.exe, 0000000E.00000002.2369315666.0000000004AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ssxd.mediav.com/s?type=1&r=20&tid=NzM0Zjg5YmY0NzhiZGY5ZTk0OTBhYzQ5NmMyYmQ3NzQ&finfo=DAABCAABA
Source: MiniNews.exe, 0000000E.00000002.2353798975.0000000002EDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ssxd.mediav.com/s?type=2&r=20&mv_ref=www.ludashi.com&enup=CAABVBE0LQgAAi00EVQA&mvid=MTkyMzgzN
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://sv.symcd.com0&
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcacomb1.crl0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://web.ncdc.gov.sa/crl/nrcaparta1.crl
Source: MiniNews.exe, 0000000E.00000002.2359364044.0000000003872000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MasterPDF.exe.13.dr, MiniNews.exe.13.dr, 360NetUL.dll.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, 360Base.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://www.360.cn
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2368138541.0000000004A11000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2214192272.0000000004A11000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: MiniNews.exe, 0000000E.00000003.2214192272.0000000004A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/AC/RC/ocsp0c
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.anf.es/es/address-direccion.html
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2211501552.00000000049F2000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2217196525.00000000049F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: MiniNews.exe, 0000000E.00000003.2213934739.0000000004B3A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208172720.0000000004B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/pc-root2.pdf0
Source: MiniNews.exe, 0000000E.00000003.2213934739.0000000004B3A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208172720.0000000004B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certeurope.fr/reference/root2.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class1.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: MiniNews.exe, 0000000E.00000003.2217716532.0000000002F05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3TS.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210791788.0000000004A6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.comsign.co.il/cps0
Source: MiniNews.exe, 0000000E.00000003.2213934739.0000000004B3A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208172720.0000000004B38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.correo.com.uy/correocert/cps.pdf0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-bt0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-int0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.datev.de/zertifikat-policy-std0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.defence.gov.au/pki0
Source: MiniNews.exe, 0000000E.00000003.2208915686.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210529606.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: MiniNews.exe, 0000000E.00000003.2208915686.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210529606.0000000004A4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.disig.sk/ca0f
Source: MiniNews.exe, 0000000E.00000003.2211226738.00000000049F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-me.lv/repository0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.e-trust.be/CPS/QNcerts
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.echoworx.com/ca/root2/cps.pdf0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210704473.0000000004A63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.eme.lv/repository0
Source: MiniNews.exe, 0000000E.00000002.2368002059.00000000049F0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2211226738.00000000049F4000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2217376978.00000000049F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ica.co.il/repository/cps/PersonalID_Practice_Statement.pdf0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: 7zG.exe, 0000000D.00000003.1816096554.0000028C791DF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2381037827.000000006E781000.00000002.00000001.01000000.0000000C.sdmp, 360Base.dll.13.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2210704473.0000000004A63000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_21_1.pdf0:
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.gva.es/cps0%
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209812787.0000000004A83000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2368782815.0000000004A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.rcsc.lt/repository0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/cps/0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sk.ee/juur/crl/0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ssc.lt/cps03
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/dpc0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.suscerte.gob.ve/lcr0#
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: MiniNews.exe, 0000000E.00000003.2209858472.0000000004A13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe, 0000000E.00000002.2355004811.0000000002F1A000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr	String found in binary or memory: http://www1.ludashi.com/api/minipage.php
Source: MiniNews.exe, 0000000E.00000002.2355004811.0000000002F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.php.P
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpH
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpei
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpll
Source: MiniNews.exe, 0000000E.00000002.2355004811.0000000002F1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phppi/
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpt
Source: MiniNews.exe, 0000000E.00000002.2354207875.0000000002EEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpxe
Source: MiniNews.exe, 0000000E.00000002.2354573894.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www1.ludashi.com/api/minipage.phpxe(
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crl.anf.es/AC/ANFServerCA.crl0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: Basic.tpi.13.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, DisPatchMini.dll.13.dr, Basic.tpi.13.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: MiniNews.exe, 0000000E.00000003.2210830774.0000000004A04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://eca.hinet.net/repository0
Source: MiniNews.exe, 0000000E.00000003.2104086716.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2346992167.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000F.00000003.2249061393.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: MiniNews.exe, 0000000E.00000003.2208244089.0000000004A2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.certicamara.com/marco-legal0Z
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ACTAS/789230
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/AC/ANFServerCA.crl0
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2215494721.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.anf.es/address/)1(0&
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1807979892.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1834394734.0000028C79B17000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1792815359.0000028C77EC0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, PopMgr.tpi.13.dr, PopMgrStub.dll.13.dr, LdsWebView.dll.13.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.hu/docs/
Source: MiniNews.exe, 0000000E.00000003.2211077991.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.netlock.net/docs
Source: MiniNews.exe, 0000000E.00000003.2209067902.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: api.pdfxd.com

Contains functionality to download additional files from the internet

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3DEDB0 InternetQueryOptionW,InternetSetOptionW,CreateFileW,GetLastError,HttpQueryInfoA,HttpQueryInfoA,HttpQueryInfoA,_memset,HttpQueryInfoA,HttpQueryInfoA,HttpQueryInfoA,GetTickCount,WaitForSingleObject,InternetReadFileExA,WriteFile,GetLastError,GetLastError,CloseHandle,InternetCloseHandle,GetLastError,SetEvent,GetTickCount,WaitForSingleObject,GetTickCount,InternetCloseHandle,InternetSetStatusCallbackA,InternetCloseHandle,CloseHandle,CloseHandle,

14_2_6E3DEDB0

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.102&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.102Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJKhywEIi6vMAQj7u8wBCPq8zAEI6sDMAQicycwBCOLLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJKhywEIi6vMAQj7u8wBCPq8zAEI6sDMAQicycwBCOLLzAEImNHMAQiZ0swBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=http%3A%2F%2Fcdn-file-ssl-pc.ludashi.com%2Fpc%2Fpdf%2Fmini_20190902.7z&oit=3&cp=58&gs_rn=42&psi=WcOZ_6yD2WdHCjET&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiqj8sBCJKhywEIi6vMAQj7u8wBCPq8zAEI6sDMAQicycwBCOLLzAEImNHMAQiZ0swBSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.PlpnwD4HYro.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-D4573md5GmdJHX15d0lc3SoObhA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CLC1yQEIkrbJAQiitskBCMS2yQEIqZ3KAQiSocsBCIurzAEI+7vMAQj6vMwBCJjRzAE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+620; __Secure-ENID=6.SE=cJKCBuSaL1dV3R8z2Y2al7-m2m5bGA74lqbYYkqC3uy-NtZ1f6n_bCBr25tlnnjvdmLpGQ81ZKzP3Te5vVjpSQjYWCwvlOMApK7tmZNWcORu0p4wniPJGQfTslQNnpQWhG9qkwkEgy49-6UG3UQ1eiUyFolJZWLeUM1p4KvjM9E
Source: global traffic	HTTP traffic detected: GET /pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700 HTTP/1.1Host: api.pdfxd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700 HTTP/1.1Host: api.pdfxd.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: api.pdfxd.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://api.pdfxd.com/pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pc/pdf/mini_20190902.7z HTTP/1.1Host: cdn-file-ssl-pc.ludashi.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage&action=manually&ex_ary[ex3]=noset&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage&action=run&ex_ary[ex3]=noset&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=1.5019.1030.826&type=minipage&action=screen_resolution_change&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /n/mini?pid=&appver=2.0.0.1010&modver=1.5019.1030.826&from=xundu&iever=ie11&os=win10&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&manual=1&showpro=&awake=0&screentype=0&screesize=1280_1024&atr=1&source=&instdate=&atdate=&m_ver=3.0.0.1085 HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)Host: media.ludashi.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage_skin&action=request&ex_ary[ex3]=larger&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage&action=manually&ex_ary[ex3]=larger&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /s?type=1&of=4&newf=2&showids=Kf4chm&mid=0ee28fbdc66209b6fd4684a055d0db85&uid=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&ref=%77%77%77%2e%6c%75%64%61%73%68%69%2e%63%6f%6d&ua=%4c%75%44%61%53%68%69%2f%33%2e%30%2e%30%2e%31%30%38%35%20%28%57%69%6e%64%6f%77%73%29 HTTP/1.1Accept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)Host: show.g.mediav.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage_skin&action=parse_360skin_cfg_succ&ex_ary[ex3]=larger&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /url4?pid=&mid=0ee28fbdc66209b6fd4684a055d0db85&mid2=eeeeeeee6cfa339cef05e2eb639099b5e2fa29b329f4&appver=2.0.0.1010&modver=3.0.0.1085&type=minipage_skin&action=parse_360skin_cfg_succ&ex_ary[ex3]=larger&ex4=202aef4654876fae2ab7d3efa1473511&ex5=1 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.ludashi.comConnection: Keep-Alive

System Summary

Detected potential crypto function

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F1E27		14_2_6E3F1E27
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3E4E80		14_2_6E3E4E80
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3E5EF4		14_2_6E3E5EF4
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F8FC0		14_2_6E3F8FC0
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F9420		14_2_6E3F9420
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F8C90		14_2_6E3F8C90
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F2A63		14_2_6E3F2A63
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D1A60		14_2_6E3D1A60
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F3A51		14_2_6E3F3A51
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D9A80		14_2_6E3D9A80
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F236B		14_2_6E3F236B
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D1BB0		14_2_6E3D1BB0
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D1050		14_2_6E3D1050
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3DB890		14_2_6E3DB890
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D3880		14_2_6E3D3880
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F18E3		14_2_6E3F18E3
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F58D0		14_2_6E3F58D0
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3D1148		14_2_6E3D1148
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3F6182		14_2_6E3F6182
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E4EEF30		14_2_6E4EEF30
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E506E70		14_2_6E506E70
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E528FF0		14_2_6E528FF0
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E4F0DC0		14_2_6E4F0DC0
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E522880		14_2_6E522880
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E518671		14_2_6E518671
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E50E420		14_2_6E50E420
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E508500		14_2_6E508500
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E5183B6		14_2_6E5183B6
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E508040		14_2_6E508040
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E5180EF		14_2_6E5180EF
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E51C128		14_2_6E51C128
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E517E45		14_2_6E517E45
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E51BEF9		14_2_6E51BEF9

Found potential string decryption / allocating functions

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: String function: 6E5148A6 appears 37 times
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: String function: 6E4ECAF0 appears 55 times
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: String function: 6E3D7C70 appears 50 times
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: String function: 6E3E55C4 appears 37 times
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: String function: 6E4E9B10 appears 31 times

Contains functionality to communicate with device drivers

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E512290: CreateFileW,DeviceIoControl,CloseHandle,InterlockedCompareExchange,CloseHandle,

14_2_6E512290

PE file contains executable resources (Code or Archives)

Source: MiniNews.exe.13.dr

Static PE information: Resource name: RES_ZIP type: Zip archive data, at least v2.0 to extract, compression method=store

Reads software policies

Source: C:\Program Files\7-Zip\7zG.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://api.pdfxd.com/pdf-service/v1/action?os=163842&device_id=741e5fc1b4d58e5b4c3ac5f1dc5a9464&version=&qd=&day=&t=4312453&product=xundu&machine_name=141700
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1792,i,10598242960263132774,10547462125382206053,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Downloads\" -an -ai#7zMap23795:90:7zEvent23411
Source: unknown	Process created: C:\Users\user\Downloads\Utils\MiniNews.exe "C:\Users\user\Downloads\Utils\MiniNews.exe"
Source: unknown	Process created: C:\Users\user\Downloads\Utils\MiniNews.exe "C:\Users\user\Downloads\Utils\MiniNews.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1792,i,10598242960263132774,10547462125382206053,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E502A00 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,GetShellWindow,GetWindowThreadProcessId,OpenProcess,OpenProcessToken,GetTokenInformation,DuplicateTokenEx,CloseHandle,CloseHandle,

14_2_6E502A00

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\971c3db5-228d-4e34-ad97-a62124199b4b.tmp

Jump to behavior

Creates temporary files

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

File created: C:\Users\user\AppData\Local\Temp\{F3FCDC60-415D-413c-8D13-838A625F6F57}.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal48.evad.win@37/151@13/14

SQL strings found in memory and binary data

Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	Binary or memory string: SELECT * FROM cookies;
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr, Basic.tpi.13.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Contains functionality to enum processes or threads

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E4FC8B0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,Process32NextW,CloseHandle,FindWindowW,IsWindow,EnterCriticalSection,LeaveCriticalSection,

14_2_6E4FC8B0

Creates mutexes

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 5696
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 3924
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Mutant created: \Sessions\1\BaseNamedObjects\Q360ComputerzMiniNewsMutextNameMasterPdf

Contains functionality to load and extract PE file embedded resources

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3D4D40 LoadResource,LockResource,SizeofResource,

14_2_6E3D4D40

Creates files inside the program directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Reads the hosts file

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Creates a directory in C:\Program Files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsIeView.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsWebView.pdb; source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, LdsWebView.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgr.pdb$p source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\347776\out\Release\MiniNews.pdb source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000000.2055978965.0000000000260000.00000002.00000001.01000000.0000000A.sdmp, MiniNews.exe.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgrStub.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2377952920.000000006E687000.00000002.00000001.01000000.0000000E.sdmp, PopMgrStub.dll.13.dr
Source:	Binary string: D:\build\lib_common\basic\Release\Basic.pdb source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, Basic.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\356471\out\Release\LdsWebView.pdb source: 7zG.exe, 0000000D.00000003.1829396154.0000028C797B0000.00000004.00000800.00020000.00000000.sdmp, LdsWebView.dll.13.dr
Source:	Binary string: d:\build\360cloud_build\360NetUL_base1031\bin\360NetUL.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2189831952.0000000002EE3000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2246706121.0000000003D01000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2371078507.000000006E3FB000.00000002.00000001.01000000.00000010.sdmp, 360NetUL.dll.13.dr
Source:	Binary string: c:\code\android\donut\development\host\windows\usb\winusb\objfre_wxp_x86\i386\AdbWinUsbApi.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MasterPDF.exe.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgrStub.pdb source: 7zG.exe, 0000000D.00000003.1816431295.0000028C79215000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2377952920.000000006E687000.00000002.00000001.01000000.0000000E.sdmp, PopMgrStub.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\278377\out\Release\PopMgr.pdb source: 7zG.exe, 0000000D.00000003.1789779811.0000028C77BB0000.00000004.00000800.00020000.00000000.sdmp, PopMgr.tpi.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\342920\out\Release\Basic.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, LDSBasic.dll.13.dr
Source:	Binary string: E:\build\360BaseNew\360Base\Release\360Base.pdb source: 7zG.exe, 0000000D.00000003.1816096554.0000028C791DF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2381037827.000000006E781000.00000002.00000001.01000000.0000000C.sdmp, 360Base.dll.13.dr
Source:	Binary string: C:\vmagent_new\bin\joblist\376264\out\Release\DisPatchMini.pdb source: 7zG.exe, 0000000D.00000003.1818653292.0000028C793AF000.00000004.00000800.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp, DisPatchMini.dll.13.dr

Data Obfuscation

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3E5609 push ecx; ret		14_2_6E3E561C
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 15_2_0377CDFC push esp; iretd		15_2_0377CEBD
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 15_2_0377CDD3 pushfd ; iretd		15_2_0377CDF1
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 15_2_0377CCDC pushfd ; iretd		15_2_0377CDF1
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 15_2_0377CCDC push esp; iretd		15_2_0377CEBD

PE file contains sections with non-standard names

Source: LdsWebView.dll.13.dr	Static PE information: section name: .shared
Source: LdsWebView.dll.13.dr	Static PE information: section name: .00cfg

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3EFF15 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

14_2_6E3EFF15

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileW,DeviceIoControl,CloseHandle,InterlockedCompareExchange,CloseHandle, \\.\PhysicalDrive%d		14_2_6E512290
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		14_2_6E513D60
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		14_2_6E513660

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\plugin\Basic.tpi			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\plugin\PopMgr.tpi			Jump to dropped file

Drops PE files

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Utils\MiniNews.exe			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\plugin\PopMgrStub.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Utils\ie\LdsIeView.exe			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Utils\LDSBasic.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\360Base.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\360NetUL.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\plugin\Basic.tpi			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\plugin\PopMgr.tpi			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Utils\LdsWebView.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Utils\DisPatchMini.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\MasterPDF.exe			Jump to dropped file

Contains functionality to read ini properties file for application configuration

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E4ED8F0 FindResourceExW,FindResourceW,GetPrivateProfileStringW,

14_2_6E4ED8F0

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileW,DeviceIoControl,CloseHandle,InterlockedCompareExchange,CloseHandle, \\.\PhysicalDrive%d		14_2_6E512290
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d		14_2_6E513D60
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: CreateFileA,DeviceIoControl,CloseHandle,CloseHandle, \\.\PhysicalDrive%d		14_2_6E513660

Hooking and other Techniques for Hiding and Protection

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E506E70 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

14_2_6E506E70

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DisPatchMini.dll.13.dr	Binary or memory string: POPMGRSTUB.DLLPLUGIN\POPMGRSTUB.DLLTRAYSUBCENTER_GROUP1EVERYTHING.EXEEVERYTHINGDEBARB_DEVSPY.EXESPY++.EXESPYXXPROCESSPACKETSPYXX_AMD64.EXEPROCEXP.EXEPROCEXPLPROCEXP64.EXEFIDDLER.EXEWINDOWSFORMS10.WINDOW.8.APP.0.141B42A_R12_AD1SMSNIFF.EXEMINISNIFFER.EXEWIRESHARK.EXEWINDBG.EXEOLLYDBG.EXEIDAG.EXEIDAQ.EXEIDAQ64.EXE>T1R4X
Source: MiniNews.exe, MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE
Source: MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE\ROAM
Source: MiniNews.exe, MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: MiniNews.exe, 0000000E.00000002.2373281942.000000006E544000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: ONPOPMGRSTUB.DLLPLUGIN\POPMGRSTUB.DLLTRAYSUBCENTER_GROUP1EVERYTHING.EXEEVERYTHINGDEBARB_DEVSPY.EXESPY++.EXESPYXXPROCESSPACKETSPYXX_AMD64.EXEPROCEXP.EXEPROCEXPLPROCEXP64.EXEFIDDLER.EXEWINDOWSFORMS10.WINDOW.8.APP.0.141B42A_R12_AD1SMSNIFF.EXEMINISNIFFER.EXEWIRESHARK.EXEWINDBG.EXEOLLYDBG.EXEIDAG.EXEIDAQ.EXEIDAQ64.EXE>T1R4X
Source: MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXEU
Source: MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAG.EXEATA\LOC
Source: MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEE=C:
Source: MiniNews.exe, MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: MiniNews.exe.13.dr	Binary or memory string: H*0EVERYTHING.EXEEVERYTHINGDEBARB_DEVSPY.EXESPY++.EXESPYXXPROCESSPACKETSPYXX_AMD64.EXEPROCEXP.EXEPROCEXPLPROCEXP64.EXEFIDDLER.EXEWINDOWSFORMS10.WINDOW.8.APP.0.141B42A_R12_AD1SMSNIFF.EXEMINISNIFFER.EXEWIRESHARK.EXEWINDBG.EXEOLLYDBG.EXEIDAG.EXEIDAQ.EXEIDAQ64.EXE>T1R4X
Source: MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MINISNIFFER.EXE3
Source: MiniNews.exe, MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MINISNIFFER.EXE
Source: MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEOWI
Source: MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE6
Source: MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXENUML
Source: MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MINISNIFFER.EXE9
Source: MiniNews.exe, MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE_STRING
Source: MiniNews.exe, MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: MiniNews.exe, 0000000E.00000002.2352715994.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXEMON FIL
Source: MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXEPROGRAM

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E4FC8B0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,Process32NextW,CloseHandle,FindWindowW,IsWindow,EnterCriticalSection,LeaveCriticalSection,

14_2_6E4FC8B0

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_14-40218

Found dropped PE file which has not been started or loaded

Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Utils\ie\LdsIeView.exe			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Utils\LDSBasic.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\plugin\Basic.tpi			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\plugin\PopMgr.tpi			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Utils\LdsWebView.dll			Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\MasterPDF.exe			Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_14-39881

Contains capabilities to detect virtual machines

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0001 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0010 name: DriverDesc			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\0011 name: DriverDesc			Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

File opened: PhysicalDrive0

Jump to behavior

Contains functionality to query network adapater information

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: InternetGetConnectedState,GetAdaptersInfo,GetAdaptersInfo,InterlockedDecrement,		14_2_6E515F00
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,MultiByteToWideChar,MultiByteToWideChar,StrStrIA,StrStrIA,GetProcessHeap,HeapFree,		14_2_6E5108D0

Queries a list of all running processes

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Process information queried: ProcessInformation

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E534898 FindFirstFileExA,

14_2_6E534898

Program exit points

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

API call chain: ExitProcess graph end node

graph_14-41336

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: MiniNews.exe, 0000000E.00000003.2103990481.0000000002E6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW|
Source: MiniNews.exe, 0000000E.00000003.2105090956.0000000000E18000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2348768192.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: MiniNews.exe, 0000000E.00000003.2162150193.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000002.2347833139.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000E.00000003.2104453896.0000000000DDD000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000F.00000002.2268995710.0000000000B39000.00000004.00000020.00020000.00000000.sdmp, MiniNews.exe, 0000000F.00000003.2250843606.0000000000B2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&
Source: MiniNews.exe, 0000000F.00000003.2249655653.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3E3CBF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

14_2_6E3E3CBF

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E4FC8B0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,Process32NextW,CloseHandle,FindWindowW,IsWindow,EnterCriticalSection,LeaveCriticalSection,

14_2_6E4FC8B0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3EFF15 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

14_2_6E3EFF15

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3FABD6 GetProcessHeap,

14_2_6E3FABD6

Contains functionality to register its own exception handler

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3E3CBF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		14_2_6E3E3CBF
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3ED56D __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		14_2_6E3ED56D
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E3E2840 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		14_2_6E3E2840
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: 14_2_6E51A05F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		14_2_6E51A05F

HIPS / PFW / Operating System Protection Evasion

May try to detect the Windows Explorer process (often used for injection)

Source: Basic.tpi.13.dr

Binary or memory string: WorkerWSHELLDLL_DefViewSysListView32Program ManagerProgmanGet desktop wnd =

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_close.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_mini.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_setting.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_tab.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_tab2.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_tab_mark.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_tab_mark2.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_load_start.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_add.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_remove.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_menu_bar.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_show_forever.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_show_day.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_show_week.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_menu_checked.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_menu_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_load_refresh.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_load_failed.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_load_crash.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_shortcut_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_shortcut_later.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_shortcut_now.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_nopop_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_report_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_msgbox_close.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_close_white_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_close_ad.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_caption.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_icon.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\news_tab_icon.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_menu_shortcut.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_menu_splitline.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_mask.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\browser_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_guide_mask.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_guide_mask_mid.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_guide_mask_wide.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_try.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_try.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_awake_try_wide.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_submitting.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_success.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_networkbad.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_edit.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_progress_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_progress_frg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_check.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_report_retry_submit.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\news_toast_bkg.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\common\title_mask.png VolumeInformation			Jump to behavior
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Queries volume information: C:\Users\user\AppData\Roaming\xundu\Mininews\newsui\MininewsRes\xundu\900_53_title.png VolumeInformation			Jump to behavior

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: GetLocaleInfoA,		14_2_6E3F0580
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		14_2_6E536F27
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: GetLocaleInfoW,		14_2_6E530AC6
Source: C:\Users\user\Downloads\Utils\MiniNews.exe	Code function: EnumSystemLocalesW,		14_2_6E53062B

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E514230 cpuid

14_2_6E514230

Contains functionality to query local / system time

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E3EEE0F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

14_2_6E3EEE0F

Contains functionality to query time zone information

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E53030F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

14_2_6E53030F

Contains functionality to query windows version

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E50F100 GetVersionExW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetCurrentProcess,GetModuleHandleW,GetProcAddress,GetSystemWindowsDirectoryW,PathCombineW,LoadLibraryExW,FindResourceW,SizeofResource,LoadResource,LockResource,FreeResource,FreeLibrary,VerQueryValueW,

14_2_6E50F100

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: MiniNews.exe, MiniNews.exe, 0000000E.00000002.2341776175.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: MiniNews.exe, MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: MiniNews.exe, MiniNews.exe, 0000000F.00000002.2267187317.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\Downloads\Utils\MiniNews.exe

Code function: 14_2_6E4E20C0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,

14_2_6E4E20C0