Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
MQNT.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\Desktop\update.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
|
|
C:\Users\user\Desktop\desktop.ini
|
Unicode text, UTF-16, little-endian text, with CRLF line terminators
|
modified
|
||
|
C:\Users\user\Documents\19CAD721B59B09B208B5A7E2F6387843.ico
|
MS Windows icon resource - 1 icon, -128x-128, 32 bits/pixel
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\MQNT.exe
|
"C:\Users\user\Desktop\MQNT.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://47.92.98.180:88/MQNT/MQNT.exe
|
unknown
|
|
|
|
http://47.92.98.180:88/MQNT/GX_RZ.txt
|
unknown
|
||
|
http://www.eyuyan.com)DVarFileInfo$
|
unknown
|
||
|
https://api.ip.sb/ip
|
unknown
|
||
|
https://club.vip.qq.com/api/aggregation?g_tk=
|
unknown
|
||
|
http://whois.pconline.com.cn/ipJson.jsp?json=true
|
unknown
|
||
|
http://www.ip138.comUser-Agent:
|
unknown
|
||
|
https://club.vip.qq.com/api/aggregation?g_tk=content-type:
|
unknown
|
||
|
http://www.eyuyan.comservice
|
unknown
|
||
|
http://www.ibsensoftware.com/
|
unknown
|
||
|
https://cdid.c-ctrip.com/model-poc2/h
|
unknown
|
||
|
https://cdid.c-ctrip.com/model-poc2/hhttps://ip.cn/api/index?ip=&type=0User-Agent:
|
unknown
|
||
|
https://ipinfo.io/json
|
unknown
|
||
|
https://ip.cn/api/index?ip=&type=0
|
unknown
|
||
|
https://www.uc.cn/ipIP:https://api.ip.sb/iphttps://ipinfo.io/jsonip
|
unknown
|
||
|
http://www.eyuyan.com
|
unknown
|
||
|
http://ip-api.com/json/?lang=zh-CN
|
unknown
|
||
|
https://www.baidu.comDate:KB3140245/
|
unknown
|
||
|
http://47.92.98.180:88/MQNT/data.txt
|
unknown
|
||
|
http://q1.qlogo.cn/g?b=qq&nk=
|
unknown
|
||
|
https://www.uc.cn/ip
|
unknown
|
||
|
http://www.ip138.com
|
unknown
|
||
|
http://47.92.98.180:18081/myauth/web/getUserCount?skey=c0ecd8de-75e7-47a6-a22b-8adedbf78780&apikey=c
|
unknown
|
||
|
https://www.baidu.com
|
unknown
|
There are 14 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
www.wshifen.com
|
103.235.46.96
|
||
|
18.31.95.13.in-addr.arpa
|
unknown
|
||
|
www.baidu.com
|
unknown
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
103.235.46.96
|
www.wshifen.com
|
Hong Kong
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
|
GlobalAssocChangedCounter
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
6CD000
|
unkown
|
page readonly
|
|
|
|
6CD000
|
unkown
|
page readonly
|
|
|
|
326B000
|
heap
|
page read and write
|
||
|
CE2000
|
heap
|
page read and write
|
||
|
3283000
|
heap
|
page read and write
|
||
|
C91000
|
heap
|
page read and write
|
||
|
99F000
|
unkown
|
page read and write
|
||
|
C6F000
|
heap
|
page read and write
|
||
|
3388000
|
heap
|
page read and write
|
||
|
BC6000
|
heap
|
page read and write
|
||
|
C6D000
|
heap
|
page read and write
|
||
|
A0E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
923000
|
unkown
|
page read and write
|
||
|
C6F000
|
heap
|
page read and write
|
||
|
34A0000
|
trusted library allocation
|
page read and write
|
||
|
C91000
|
heap
|
page read and write
|
||
|
32BE000
|
heap
|
page read and write
|
||
|
32C8000
|
heap
|
page read and write
|
||
|
32C2000
|
heap
|
page read and write
|
||
|
3268000
|
heap
|
page read and write
|
||
|
32BE000
|
heap
|
page read and write
|
||
|
32C8000
|
heap
|
page read and write
|
||
|
915000
|
unkown
|
page write copy
|
||
|
2A3E000
|
stack
|
page read and write
|
||
|
326B000
|
heap
|
page read and write
|
||
|
9A1000
|
unkown
|
page readonly
|
||
|
328C000
|
heap
|
page read and write
|
||
|
32C8000
|
heap
|
page read and write
|
||
|
314E000
|
stack
|
page read and write
|
||
|
C25000
|
heap
|
page read and write
|
||
|
BFA000
|
heap
|
page read and write
|
||
|
2760000
|
remote allocation
|
page read and write
|
||
|
6190000
|
trusted library allocation
|
page read and write
|
||
|
93E000
|
unkown
|
page write copy
|
||
|
2DBF000
|
stack
|
page read and write
|
||
|
C2B000
|
heap
|
page read and write
|
||
|
C9E000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3289000
|
heap
|
page read and write
|
||
|
2B3D000
|
stack
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
34A0000
|
trusted library allocation
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
32BE000
|
heap
|
page read and write
|
||
|
C8C000
|
heap
|
page read and write
|
||
|
BFE000
|
heap
|
page read and write
|
||
|
3289000
|
heap
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
5E5000
|
unkown
|
page readonly
|
||
|
988000
|
unkown
|
page read and write
|
||
|
3265000
|
heap
|
page read and write
|
||
|
915000
|
unkown
|
page write copy
|
||
|
3260000
|
heap
|
page read and write
|
||
|
93A000
|
unkown
|
page read and write
|
||
|
92A000
|
unkown
|
page read and write
|
||
|
C27000
|
heap
|
page read and write
|
||
|
A4E000
|
stack
|
page read and write
|
||
|
328C000
|
heap
|
page read and write
|
||
|
327B000
|
heap
|
page read and write
|
||
|
3600000
|
heap
|
page read and write
|
||
|
9C0000
|
heap
|
page read and write
|
||
|
999000
|
unkown
|
page read and write
|
||
|
29FE000
|
stack
|
page read and write
|
||
|
2785000
|
heap
|
page read and write
|
||
|
328C000
|
heap
|
page read and write
|
||
|
C6D000
|
heap
|
page read and write
|
||
|
CA8000
|
heap
|
page read and write
|
||
|
CAC000
|
heap
|
page read and write
|
||
|
32E6000
|
heap
|
page read and write
|
||
|
BC0000
|
heap
|
page read and write
|
||
|
32C8000
|
heap
|
page read and write
|
||
|
C8C000
|
heap
|
page read and write
|
||
|
2740000
|
heap
|
page read and write
|
||
|
C6F000
|
heap
|
page read and write
|
||
|
5E5000
|
unkown
|
page readonly
|
||
|
2760000
|
remote allocation
|
page read and write
|
||
|
2744000
|
heap
|
page read and write
|
||
|
924000
|
unkown
|
page write copy
|
||
|
32C8000
|
heap
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
3282000
|
heap
|
page read and write
|
||
|
C78000
|
heap
|
page read and write
|
||
|
C78000
|
heap
|
page read and write
|
||
|
94B000
|
unkown
|
page read and write
|
||
|
CE2000
|
heap
|
page read and write
|
||
|
95000
|
stack
|
page read and write
|
||
|
32BC000
|
heap
|
page read and write
|
||
|
3273000
|
heap
|
page read and write
|
||
|
CA8000
|
heap
|
page read and write
|
||
|
3250000
|
heap
|
page read and write
|
||
|
DEE000
|
stack
|
page read and write
|
||
|
C78000
|
heap
|
page read and write
|
||
|
CE2000
|
heap
|
page read and write
|
||
|
2B7E000
|
stack
|
page read and write
|
||
|
32BC000
|
heap
|
page read and write
|
||
|
C5B000
|
heap
|
page read and write
|
||
|
28FD000
|
stack
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
EEF000
|
stack
|
page read and write
|
||
|
328C000
|
heap
|
page read and write
|
||
|
3289000
|
heap
|
page read and write
|
||
|
C9F000
|
heap
|
page read and write
|
||
|
93F000
|
unkown
|
page read and write
|
||
|
919000
|
unkown
|
page write copy
|
||
|
2CBE000
|
stack
|
page read and write
|
||
|
C6F000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
CA3000
|
heap
|
page read and write
|
||
|
32BF000
|
heap
|
page read and write
|
||
|
32C9000
|
heap
|
page read and write
|
||
|
CE2000
|
heap
|
page read and write
|
||
|
3261000
|
heap
|
page read and write
|
||
|
3380000
|
heap
|
page read and write
|
||
|
92B000
|
unkown
|
page write copy
|
||
|
CE2000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2780000
|
heap
|
page read and write
|
||
|
3282000
|
heap
|
page read and write
|
||
|
3282000
|
heap
|
page read and write
|
||
|
9A1000
|
unkown
|
page readonly
|
||
|
A85000
|
heap
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
2760000
|
remote allocation
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
917000
|
unkown
|
page read and write
|
||
|
C8C000
|
heap
|
page read and write
|
||
|
BCB000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
328C000
|
heap
|
page read and write
|
||
|
324F000
|
stack
|
page read and write
|
||
|
C78000
|
heap
|
page read and write
|
||
|
C29000
|
heap
|
page read and write
|
||
|
32BC000
|
heap
|
page read and write
|
||
|
C8C000
|
heap
|
page read and write
|
||
|
2C7F000
|
stack
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
CA1000
|
heap
|
page read and write
|
||
|
32BC000
|
heap
|
page read and write
|
||
|
C9D000
|
heap
|
page read and write
|
||
|
CA1000
|
heap
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
93E000
|
unkown
|
page write copy
|
There are 133 hidden memdumps, click here to show them.