Starting from the malwaretracker sample (see my previous posts) seem that edx and ecx are set to some interesting values:
↧
Channel:
extraexploit
X
Are you the publisher?
Claim or
contact us
about this channel.
X
0
Channel Details:
- Title: extraexploit
- Channel Number: 6195240
- Language: English
- Registered On: December 9, 2012, 6:40 am
- Number of Articles: 25
- Latest Snapshot: September 21, 2014, 5:48 pm
- RSS URL: http://extraexploit.blogspot.com/feeds/posts/default?alt=rss
- Publisher: http://extraexploit.blogspot.com/
- Description:
- Catalog: //extraexploit1.rssing.com/catalog.php?indx=6195240
© 2024 //www.rssing.com