Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Temp\is-O2DFQ.tmp\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\is-2KP2F.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\AppData\Local\Temp\is-O2DFQ.tmp\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.tmp
|
"C:\Users\user\AppData\Local\Temp\is-O2DFQ.tmp\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.tmp"
/SL5="$103E6,76800,76800,C:\Users\user\Desktop\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.exe"
|
|
|
|
C:\Windows\SysWOW64\shutdown.exe
|
"shutdown.exe" -r -f -t 0
|
|
|
|
C:\Users\user\Desktop\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.not-a-virus.HEUR.AdWare.Win32.Convagent.gen.29670.14571.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.innosetup.com/
|
unknown
|
||
|
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
|
unknown
|
||
|
http://www.remobjects.com/psU
|
unknown
|
||
|
http://www.remobjects.com/ps
|
unknown
|
||
|
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Owner
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
SessionHash
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
|
Sequence
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
401000
|
unkown
|
page execute read
|
||
|
2F3C000
|
heap
|
page read and write
|
||
|
49F000
|
unkown
|
page write copy
|
||
|
401000
|
unkown
|
page execute read
|
||
|
2E6C000
|
stack
|
page read and write
|
||
|
2208000
|
direct allocation
|
page read and write
|
||
|
6D6000
|
heap
|
page read and write
|
||
|
40C000
|
unkown
|
page write copy
|
||
|
3250000
|
heap
|
page read and write
|
||
|
99F000
|
stack
|
page read and write
|
||
|
49D000
|
unkown
|
page read and write
|
||
|
21F9000
|
heap
|
page read and write
|
||
|
2EAC000
|
stack
|
page read and write
|
||
|
5F8000
|
heap
|
page read and write
|
||
|
315D000
|
stack
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
5F0000
|
heap
|
page read and write
|
||
|
21E0000
|
direct allocation
|
page read and write
|
||
|
3200000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2F20000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
23B0000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
420000
|
heap
|
page read and write
|
||
|
6A0000
|
heap
|
page read and write
|
||
|
33FF000
|
stack
|
page read and write
|
||
|
6BC000
|
heap
|
page read and write
|
||
|
34FF000
|
stack
|
page read and write
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
690000
|
direct allocation
|
page execute and read and write
|
||
|
6A8000
|
heap
|
page read and write
|
||
|
6E4000
|
heap
|
page read and write
|
||
|
2230000
|
direct allocation
|
page read and write
|
||
|
21F5000
|
heap
|
page read and write
|
||
|
31AE000
|
stack
|
page read and write
|
||
|
40E000
|
unkown
|
page write copy
|
||
|
2260000
|
heap
|
page read and write
|
||
|
2484000
|
heap
|
page read and write
|
||
|
3110000
|
heap
|
page read and write
|
||
|
2480000
|
heap
|
page read and write
|
||
|
20A1000
|
direct allocation
|
page read and write
|
||
|
49B000
|
unkown
|
page read and write
|
||
|
412000
|
unkown
|
page readonly
|
||
|
27D0000
|
trusted library allocation
|
page read and write
|
||
|
6E6000
|
heap
|
page read and write
|
||
|
4AD000
|
unkown
|
page readonly
|
||
|
2207000
|
direct allocation
|
page read and write
|
||
|
223C000
|
direct allocation
|
page read and write
|
||
|
51E000
|
stack
|
page read and write
|
||
|
550000
|
heap
|
page read and write
|
||
|
2090000
|
direct allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
6E2000
|
heap
|
page read and write
|
||
|
49B000
|
unkown
|
page write copy
|
||
|
2200000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
8EF000
|
stack
|
page read and write
|
||
|
2160000
|
heap
|
page read and write
|
||
|
6E6000
|
heap
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
2218000
|
direct allocation
|
page read and write
|
||
|
2F3A000
|
heap
|
page read and write
|
||
|
6E6000
|
heap
|
page read and write
|
||
|
2218000
|
direct allocation
|
page read and write
|
||
|
2223000
|
direct allocation
|
page read and write
|
||
|
64E000
|
stack
|
page read and write
|
||
|
2224000
|
direct allocation
|
page read and write
|
||
|
536000
|
heap
|
page read and write
|
||
|
321E000
|
stack
|
page read and write
|
||
|
2F28000
|
heap
|
page read and write
|
||
|
49C000
|
unkown
|
page write copy
|
||
|
3110000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
59E000
|
stack
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
3020000
|
heap
|
page read and write
|
||
|
2170000
|
heap
|
page read and write
|
||
|
6E2000
|
heap
|
page read and write
|
||
|
319E000
|
stack
|
page read and write
|
||
|
53E000
|
stack
|
page read and write
|
||
|
40C000
|
unkown
|
page read and write
|
||
|
540000
|
heap
|
page read and write
|
||
|
215C000
|
direct allocation
|
page read and write
|
||
|
316E000
|
stack
|
page read and write
|
||
|
6E6000
|
heap
|
page read and write
|
||
|
3040000
|
heap
|
page read and write
|
||
|
20A8000
|
direct allocation
|
page read and write
|
||
|
23B0000
|
direct allocation
|
page read and write
|
||
|
2228000
|
direct allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
20A4000
|
direct allocation
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
2238000
|
direct allocation
|
page read and write
|
||
|
4D0000
|
heap
|
page read and write
|
||
|
27F0000
|
heap
|
page read and write
|
||
|
7EF000
|
stack
|
page read and write
|
||
|
2234000
|
direct allocation
|
page read and write
|
||
|
21F0000
|
heap
|
page read and write
|
||
|
2208000
|
direct allocation
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
6DA000
|
heap
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
222C000
|
direct allocation
|
page read and write
|
||
|
98000
|
stack
|
page read and write
|
||
|
530000
|
heap
|
page read and write
|
||
|
20A1000
|
direct allocation
|
page read and write
|
||
|
31DE000
|
stack
|
page read and write
|
||
|
6E2000
|
heap
|
page read and write
|
||
|
412000
|
unkown
|
page readonly
|
There are 100 hidden memdumps, click here to show them.