Malware Analysis Report

2024-10-19 11:32

Sample ID 240527-x2wc6aga96
Target 19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b
SHA256 19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b
Tags
microsoft persistence phishing product:outlook upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b

Threat Level: Known bad

The file 19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b was found to be: Known bad.

Malicious Activity Summary

microsoft persistence phishing product:outlook upx

Detected microsoft outlook phishing page

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Modifies system certificate store

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 19:21

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 19:21

Reported

2024-05-27 19:24

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe

"C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8

Network

Country Destination Domain Proto
N/A 10.213.60.59:1034 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
N/A 192.168.2.155:1034 tcp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 192.168.2.111:1034 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
BE 173.194.76.27:25 aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.1.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.10.14:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 36.215.58.216.in-addr.arpa udp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
N/A 10.227.85.66:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
NL 142.250.153.27:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 75.2.70.75:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 10.0.77.20:1034 tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
NL 142.251.9.26:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mx.acm.org udp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 52.101.10.4:25 outlook-com.olc.protection.outlook.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 85.187.148.2:25 mail.gzip.org tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 192.168.56.176:1034 tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.250.153.27:25 aspmx2.googlemail.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 52.96.222.226:25 outlook.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 65.254.250.102:25 mail.burtleburtle.net tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 smtp.gzip.org udp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 mail.com udp
US 8.8.8.8:53 mx00.mail.com udp
US 74.208.5.20:25 mx00.mail.com tcp
N/A 192.168.2.10:1034 tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 hachyderm.io udp
BE 173.194.76.27:25 aspmx.l.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
NL 142.251.9.27:25 aspmx3.googlemail.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 mx.outlook.com udp
US 74.208.5.20:25 mx00.mail.com tcp
US 8.8.8.8:53 mail.outlook.com udp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 smtp.outlook.com udp
GB 40.100.174.194:25 smtp.outlook.com tcp
US 8.8.8.8:53 smtp.burtleburtle.net udp
US 65.254.250.102:25 smtp.burtleburtle.net tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 mx01.mail.com udp
US 74.208.5.22:25 mx01.mail.com tcp
N/A 10.159.126.116:1034 tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp

Files

memory/3952-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1944-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 4865d2e56a56ead0c2b4822f433ec8bc
SHA1 8838aad62bd91434d014ade341abb975a6d46cf4
SHA256 f16ade756ed9047122f824e69a4aca4595ef39237762131780eaaf1fbf8d79be
SHA512 e87acf69d710f681bb0fd700bf3d1a3288322b1fea8a01beae35fe69ad969bcf8aee558b6c5b5c72195356fd41a9b0c2b4c7bd97339734981e2b5533bb96023f

memory/3952-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-14-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1944-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1944-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3952-25-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3952-30-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-31-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 55071beee7a382078846f03afde02301
SHA1 b081003b9f9d572190e9d36b544c32d7a7969249
SHA256 bb9a0413e5891a523d2732346c3683d39f55e3271699614a9bec9a960fdb3f0d
SHA512 5e3c276ba7fc49422b67440f47a71411aa5b8dad734b78611af04f2e2d56a9ef85a18da3af23a4fb92c1253c6a53a470a978b76daa6e866bfdbbb2e879ba7151

C:\Users\Admin\AppData\Local\Temp\tmpB4F3.tmp

MD5 6f673781b618a545964355123f745eb4
SHA1 ce3af938613c4ddbcdca07f27717de3a920c3940
SHA256 0b5b3ef58d38da7274a1fa9e63d5f22a5dd06763bd2f8c4127eab436dc0cb86b
SHA512 a7d34ed039a6a77872876fd8724099e96eb7d8484bc781f77983cad7065c7343d30efa69445385a0418549042117decb1db1fe6125eca068979cbf38d7b580f4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\7N09HC4T.htm

MD5 f8477dd5adba69e72a0d8c65a63a9a4f
SHA1 79f30db3001c02a8982abe5b6cdc8e20f07fca3f
SHA256 185400e123fc80c84776375abfac022237f2081df415a0182edf2f534e828fc2
SHA512 81cab0d32f700957c0d9c5efb36624ceaa8344e56ebf1453d910f1ddd4f128bb7ef7b459293207bca71251601c877019f80951f8542af0b8272ba8caf6976bf3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\search[4].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/1944-217-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3952-216-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search[6].htm

MD5 59bf3d4558f03e27a5dd2fe29d193ae3
SHA1 aac43375f026137ac7ad4ee7f8b8df05bda199dd
SHA256 65836a17480990d70a9e4c326c8c05b115460384b0473912f9a985ead1a88831
SHA512 2f904b041a9a29647d99a3ce326e8b3267da79393d8457be10965594c7f62a9cb9682bb45c793a61f9ed75eba2a4c29093f74557769fd537368b59c2fadaa5d8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\results[5].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search[2].htm

MD5 91b1e23fae7894f9320f35e1eed3fd3e
SHA1 c04098426dff7a58cbc661f0dd1a6d25355ff173
SHA256 a244a4a1acc6cc6801ebb91f45f1d4b99764b4318aa689b07f0f788fbb62ab9b
SHA512 3ff88d0dd1157ba34a502597b7d05f7079a60e8616eb7499a0aa737ac62c9aa560316d9eb14765dedb9a0453025c4fe17b973e15bbb90a46004241dd5f423044

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search[8].htm

MD5 4833b0e78f802b5f380c99efb408ba57
SHA1 71fea6c65532e0b860455062f0e11a0af9a3a7b7
SHA256 4c78c85c34dc7ba185e773ba605d3a124cd2b90e384489ca2eacf4bb6afeaf9b
SHA512 20d52070aa4908f7e824c55827d117cd6d3366b25cf93cfd5efc9da607048ad3dc34207a51c7ff972eaf567b0ea8039dc12dbdb9e4db3da0b682408867fc46d1

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5aaaae5b7a4353b1cb5d55786ece5975
SHA1 f3316e72281ef2e708f8bc392e444acf431f041f
SHA256 5a0b46763d338d0fbef0a3d9db2d3d144572157e1008ecf8cf241c507e3b55d7
SHA512 0c2a0126ee7edf2d50561a6c82e8cd8bf4c4b8f297f4a567c99a774a5ed0fb6ea73f1ee3f23c9fc07fb1577d8ecaef40ea543fbb676650f631e0253635cbd516

memory/3952-311-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-312-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1944-316-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3952-320-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-321-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5a69e0e2dc566812cea7ad2c49f5c88f
SHA1 715d9e65d98ec2eae9b3af573f8b4b5a1aeeaa85
SHA256 ab103829a16957fb79308456f2eeaad1c620543de2f6c9da7de42bda537a3bfa
SHA512 eaed81db28eb512d70895300db9f2cf95f36312bd052fd585a49c0895193272e743922ee0b7da12ee123dc8a70ff0ab004060046dbe4d986a9f4ab6a367c1c56

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search[10].htm

MD5 d9f3b869a8f16c0a258f2189f166afd0
SHA1 a35b7139cbfa2ba50a1071695a445f8411948abd
SHA256 5d819cb39a5df35cf4eb8fe61034f0d56504b2e37b7fb6d15920d319d51b46b5
SHA512 27f91e020372b5a0559c2e12b8d99387388856f74e821e9b7cde5fdb32f727850c0005f608447afa94570c853e3faabf42b075e0e0246c461b037f54e375f44c

memory/3952-367-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-368-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\searchKAD8QEAC.htm

MD5 7f26d8e8c613839e05e05e7cb81b0cc0
SHA1 13fbf0f8b3d693bcfb844f7792571ff1b82e8dbb
SHA256 1a4b803b59830b176b869380419f075545c7c250ab1a37aa9e593995d69830e9
SHA512 dade35dd09c6dda986e1aa8b4797e643a537745358b0af42371801fd934d4a770791c760c52410fdf7c4758eac13850d62f3ac59a78ddb65bea1a5378f9bfe69

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\results[7].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search3001Q5Z8.htm

MD5 e26f8d92616c3c650326503c3cf31ebf
SHA1 9da205e8c6665a4dde495e755439047dd6a398db
SHA256 64044667d6c2adcff3531a14c2793210c7571cfd11fd38580e8bf8c8a875c648
SHA512 8cc8b0f2cbdf531fa4d2f808d562e129c12114ab95085618aa00cc2f01b5745c98c05574ccb523598575d90ce9f54d44eb19bd65310b87054e80bb457eef3847

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\searchMCS39J85.htm

MD5 5519aa035bec53ca09ea24deba263165
SHA1 2b1810fa4a1d8e3ceb6d4707bde2f2398f075281
SHA256 517f6c598b05fe0a4015f892b92e46ab8be0befa127b70c007f9e5562c8e8a56
SHA512 823273a69d23e84c74a5e468124cfca341fe1d212ba269aed5bf773099b3643e640b1fd9f726ef685e7ee79911779920ee030c1738ec35a70803385091cfe713

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\search[3].htm

MD5 2ce9e5e6ef9716264955249b0cf6e4f3
SHA1 4ed53eee5079222d4e58d903e1c5b42872c0f8ae
SHA256 4321033ce9dede754901cfacda2451ca82aebaa25d3b7b362009649ace57aadc
SHA512 68887f2eb36119f1b6a1819aa609c44c9b2f92b4b94596efae8e206440df0b0f89e66c0d173c02dc159472ad7ed232650762b4fa2cf4e82e601f1bb85825b3ac

memory/3952-535-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-536-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\default[4].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\searchG7AZ0MNB.htm

MD5 2e7b211e05e376f56a8ab03a9e09fc31
SHA1 5b2a4269fc3ca70c74e082eac275343b58745a37
SHA256 5422832933b45b8d2330c4395b2da146df61ef38866521e708e2ae78d1464bb8
SHA512 d23f563674ea93ac0963e637f501bd3fda2e0cdf0f00da590e7c9a7bef8b0f72aba188ae7394754ce16b6b125a6c8b475f63f507115f6f8ea120aff9998b4ed0

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\searchZ0L1P0IH.htm

MD5 58a2c7e2fbcc25377f73a330f8f3f839
SHA1 e1e2737dc0f5e89e2bf8649c347cec7e56b7f622
SHA256 a972e5a57e699c2e9ff5654d2384c9a27399e1311ce7bf5284aafc7e54bea5c9
SHA512 c12c0041a669f70479c7c70a2639181e31f59dbeccae252d0ec302c2354198b274f78470505708804b81ad06f65e4eb5ae523baa02f3f85e267d5dd82e46578b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\default[5].htm

MD5 157431349a057954f4227efc1383ecad
SHA1 69ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA512 6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search1FX0BVJE.htm

MD5 63a07a32369f636bf877a21833d89ec2
SHA1 1967411a5e206ab8214f6953fba5ffa43e092214
SHA256 227c58b45f5c0cfd4aeaafb293bb412e8270174b26d31ac19bbd2f5a8d193bca
SHA512 1784a454d4d81d24b0340294a92559804c1d985fb87591612dcfbe2e70bbde83f360f8725af9f1b7701d18b4253445eaa9b8c223c5621ffc8c1950af3bf30d12

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\searchOM2JXK3A.htm

MD5 bae157f23345216772363722ad5d9665
SHA1 4547f62942a73b03818429bce977f26bb9631f69
SHA256 1b1c81f5fa4d606c206d4c90439bb792becc5a1b76a3a184df7dd4b2888a6085
SHA512 37010637e518095a6d4b24579bb9989cd76e6711cb3d689538f479143cd19550304a5f23600bfb5596f10e06fc513839690076333dccd27399efb8d5f341e765

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\searchH5Y8H7IQ.htm

MD5 0540b93ef42d8745157c4eeea25693e8
SHA1 669b237a59d60c58848e5e281a48d74ce07fcfa1
SHA256 647aebcb6f3f99aed45149f435a798e5ed17cfb1b96f49a4f83d111140444e06
SHA512 3ceb92a6c501b345fa39101a049f6a742071ef6532d54c2a8404a96e0794e1bcf652f09fc1e195f540c82b705aa02406be75c01fa2203b443437311764c45543

memory/3952-776-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-777-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search3WQTJMKL.htm

MD5 2dabc78cf325bd72ce38b117846b6254
SHA1 6e8a4c67d66c007829bfbd3ac6fafd0d5704dead
SHA256 43cf76f3a2aeaae1124504c8d5ef56d9afc68a532480fd38e914d7e8c0f59576
SHA512 aeb2c4a2f7787e2b8a5af6ed3508becf3adc6dfa6a295b3ab3ca29b1b61df26f8f3c09e0498cf9caacb8cbb61680c68b68bf329defee9370a3ee81735ec2b5d2

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search1P58J0YN.htm

MD5 b5c563a7e308ab5ff4f35612ce0ba533
SHA1 e9b5634444845d45289033498e1a60b701812ed9
SHA256 07ab7884a59fc21b0fcdf7e7a817a762db69e6a2cf421442fa2f70fbb4add042
SHA512 803b8c39af62355209f5b363d2e94a903a0048ebc389e16ffe852fc6e14b3a2c47c2d972b898d32a6987e289584478884fca64c3e3d6e8883eb1a0a60a6636be

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search3ZRWY9WQ.htm

MD5 4ccdd255fceeb0bc4c8b2fd846214486
SHA1 e5019be3bfb0af19cf5f9a9084ea24494fc3e908
SHA256 b071acf211aa6d9cf0589e065e888ddc64d6ca5abf15c270efd89ca35b7bde4f
SHA512 0b3206d2f5c2d3bc8eb314a757ea5d62404e0e933ae8ab6241a6ad2658d495edc9e0325bdd809c6713d058ec38fae907e9285885f69cd158d28b6f67a43aceda

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search3435QYPN.htm

MD5 907dd69a97cbb1a31631317b5817186c
SHA1 2f619e86be5e5a561c67275974d75837b4b9c71f
SHA256 e15d8cf7d675615f96b49ec29dca0416991bd3d5193ee72d8d0cd04837d0d02a
SHA512 498092282b80b22011abb856442554e3605221a16f7e4eb899b9c0d6f52fcf2c23f32ede5c7956c423da6332cc0c679d5d2063209c9ae104dada8e0873f2ed4b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\searchX920GZL1.htm

MD5 09fa575d296030c228da30ede6129999
SHA1 ccba57496618a81c488b46e35ef388a3a5f59b5c
SHA256 a1f54a2f2a944f08eabbdd2eb4385978d0c1e08b582e1e409d589114ac96d502
SHA512 9a9efa6e4fed48d58dccd3d7fc21c8dd771363369e7320f0500ceb6721d03041786390215920bfb964c8e8674af62cf3b2931db0b668e203f8aa61bd7221b211

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\searchY2IZ4TOA.htm

MD5 94d81539fd4786520594afda1c5c71b4
SHA1 2e82bd1bd9cde1aa2b97b23587193e4129fe4656
SHA256 65adc51cf1bfc53e8416eb0dc43179d59badbdc70ef5fa74e5f405b4e2ea7522
SHA512 07368db0b67bdfddfaf5fc190f35889e11410fb1b69271c688612a0f838811b29ef85b962ae6ebc0605bce601beff063f9bff15e144a80349cb74462dee95be3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\searchQK50R6F1.htm

MD5 c4991c364ff7ab12254f4cb8e5b4c2ef
SHA1 1420e8303cd26eb945ae5fbf9bae8c3ab0c8af63
SHA256 22ee59fc59132fa5dc5b8ace1865203780e2f89a062216ef7b4a26fefe652b05
SHA512 ce88a8669486a32fd09d6d0cf7cf312c65e3a5aa7093827343e307987a02820a7d1e0e4c57fb2bb16530c7925e204c4a4f67b832f0e944d85e349e50c89d4693

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\searchXDDE4DKO.htm

MD5 5458b3f1cde7c6acd15ffef7fade04da
SHA1 368a4b50da48f1d49dd1110111b3e01102e9602d
SHA256 6f1a11fec25efcc71f266408bc120be6344fe8661dbb1f23919d2024e97b7f7b
SHA512 40e38d20489528d7904653e5a400ef874a132cb6504c1dac5f3fecb5adb1f5b1d6199201950273ccc5d155272f0d92ec025792a15addeeeb5d0c0ebe18fb22f9

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 9dfc7a013c0f7abddde2039baf115a6a
SHA1 c04e938ffdc34ddc9dd042066de684b698249769
SHA256 e1e2e75d70427cfa1106d72ad53a59c137fa97302ebbc18d14330883db43cf02
SHA512 a1cfb87cbec5ed0794f7f4dd595178ce8bcd159ad1897e03f7d412eeb484a0ea7a64b275a70e24d6b15cec8f14947ffa65a0d993e50470e5f186a63c6f6182cc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\default[6].htm

MD5 5243568476eb2052b2f3b67dc9053e86
SHA1 b126aa6506772f9024b76580bdf28b45e3a7f051
SHA256 2d458622dc76eb87e44cc7db89309efdf50f99821145ae86864fd1b714cbaa80
SHA512 3c68cef4e3daa4bca6e8b3aa5a31874be1e4dec38fe9781c6fe4890980744527d0c6818eeb519f8e6b322118e1f08302d85972fa7da4ba8be9421aabf9a77833

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search[9].htm

MD5 b70dda0d434111534dd988342224d20a
SHA1 1747dea4955ccae629646d0775f4ece3d016c7fc
SHA256 4ac9b0c23abb90d59f8005d3ff2659ddde096803843c1bac641ecb61ffb0fd80
SHA512 6f403ba4d7c3d02118c34b002fb7907161248095aa38e20547a606d3ac91c85217da1ef711e1f9dd727e2b553ecede8cc579fbd86d13e07029a1ba3fc6c1ca70

memory/3952-919-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-920-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search9WTM1VHN.htm

MD5 76825051199f68b5cf572fc626ba67aa
SHA1 4a1c07bbe64dcc9bafb6df8dc597d819a41fdc5c
SHA256 a463402bc91444e33b0b71831d088fc851f3b81e488e757d21b6d9b2e28da3f1
SHA512 f64903ddd527f31dac35ef4e91b58abb3d7ff6c7ca867716d31f4cf821b998628b2b236afa4e0f0cbe8333b22f20b31b40c20658c24a9377b2066ea154b42350

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\searchGLG7PPDN.htm

MD5 71a78da2e207847455919a5141504174
SHA1 6121b6dd660e187f850e24a5c11b1f6f6f961db7
SHA256 c82e2f612419943160ba1928de251656ddc774996c04fb82e101c63c4ac94adc
SHA512 fe2ca726d112e18f8b9204f394ef534186b0c6b401b97bced5bec8959d416aa93abe8bd98b2e78bf32363b92360e281fc238869d586b2a55abd0d9029ea67157

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 f0b4a82143bde5240545e5c86449216f
SHA1 1b4750642c84ce74a68369ff34b53d2ccbeeb5f5
SHA256 169c8dd032fd2ff7a56bda6146ccf98879ffcd04275c3368026b7ba34f1d4c4e
SHA512 c1c9254dd198f6236fb68cb2742321fa9b7a9a7210a6a2f65404b8f5bd061d7ae7a9425eb1a473126637445d8e2c70e425934c128eb7b4ff332b76bb0c182e4e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\resultsM0LYBH9W.htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

memory/3952-1064-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1944-1065-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\searchIADX83KF.htm

MD5 864f1a7522571e16b2fe6a58322edc7d
SHA1 93d96ebaf9535c81d387aac7ca5d4638f0127e53
SHA256 e3501aec1de3314ab2f61abd35f97f8a34d7eec40749ecc109ea8ce76ab4d0bd
SHA512 42f589ad20d69636b108b6974616a796cc0edf7d1cfa2a959085d8019ae0bde37a5cae40623e29a64a8829f089d1b1b13eac34d3a1f4cec62041b2f4b8ffe2da

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\searchH7AR6XPY.htm

MD5 f22b8aa118ec908532993b78df2cc53e
SHA1 15320405d534f71baf5da41f3405a9e47f71060d
SHA256 81545c7019d8acbd70aa6f99d8d86aa66abca0348051750d102aa46691786178
SHA512 11d6396fcd45f360f7454912fdd5fc0faa3a6d3f7610a4641eaf2743513df5fb6281d7e6d9ba789071f67ef67d29681e0ce4b2061d84fbf1a027ebb3b5ae9f0f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\search59HK2UPX.htm

MD5 11d687e4c0707b619d0e12cee8ce5bd7
SHA1 b873ef796a1ca1e71eb3b1b598314d932e537fb6
SHA256 d7059159b1045dfe4b05ebee437b15d40215ab211805c615f1ed5e9d8f3f7a89
SHA512 f2769504b3c3f3b1fb6a4d2c5bfc87baea173f6fe36b533b3feb5dab63cbac1085dfa58883fff824a01b2730a6936038db4015f13e47bc4f0d4278784cb4bbb8

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 19:21

Reported

2024-05-27 19:24

Platform

win7-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe

"C:\Users\Admin\AppData\Local\Temp\19a1e85dc1e8af9885a139e12cd94e9acdec1bfd6aa00b956cee40316b97f51b.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.213.60.59:1034 tcp
N/A 192.168.2.155:1034 tcp
N/A 192.168.2.111:1034 tcp
N/A 10.227.85.66:1034 tcp
N/A 10.0.77.20:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.41.21:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.56.176:1034 tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
N/A 192.168.2.10:1034 tcp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
N/A 10.159.126.116:1034 tcp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 mx-in.g.apple.com udp
NL 17.57.165.2:25 mx-in.g.apple.com tcp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 aspmx.l.google.com udp
BE 74.125.206.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 search.lycos.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 www.google.com udp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 apps.identrust.com udp
FR 216.58.215.36:80 www.google.com tcp
N/A 23.63.101.152:80 tcp
N/A 23.63.101.152:80 tcp
FR 216.58.215.36:80 tcp

Files

memory/1904-2-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1904-8-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-11-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-9-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1904-17-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-18-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-23-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-37-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-42-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-43-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-48-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-49-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 71fb1e78fcb25cb09377461aec68cf33
SHA1 33640d19a1d9a277c6e5b5ced23f8dc0c32bcfcc
SHA256 2585bcbbc007a41b654ab56f9c74fc59f646dc0cccb2aefc15c9d91a93e3e86e
SHA512 a061c12e0a3b94b0f71eb54f3c937fade1f17f5dc79b95ae7b7d4532966592246e2234b500a04c88eef222f0a8bbe76fc1e1b38b4b67870b1ecf540d201a6fcf

C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp

MD5 fe3b99da118b68dce0daeb57bb59e2dc
SHA1 7c2b7e6bcd8769686ba0d25899d5f3b07c311f80
SHA256 1da417c34873a43a732f2f2cc4f4f41e396f782c4cc3c05811b47f1911b7b565
SHA512 2f4ce9663e0431a3b5046025d84508204474e0e42db6ac2e697c546562c732de9ea9ce3780debca1becb34edf059cccdff19e328b3628e7765c73254e2e44a7b

memory/1904-66-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-67-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-68-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-69-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-73-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-74-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-79-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1904-80-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1740-81-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1740-86-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5fb783cca7451170d22fd342abc452e5
SHA1 6e134d96cc313bfb728b5d3ebf45cb83a858bcee
SHA256 c7aeb92598f2dfa28d52eeae23305102fd58f91b28a75d2a1e610422f6204374
SHA512 742f30fbb42ac66e61d90247f28e7aa7b157c409debe8610c661e3fe3dd873b617a90f392f1d7aa32bee1051ed697b9b597810c089a45e218cac01c858bd8f85

C:\Users\Admin\AppData\Local\Temp\Cab6513.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar6525.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53b6ae61233953394f03f6556a4ba4b9
SHA1 30495ee14537b682f80d939f111aef559ebd50f1
SHA256 251692a1a0cd602521173863e67120ac69ba9351c3668b6c990be0809919e82e
SHA512 ea6de15df19ba9c0dcca4db8c033395934a73dfa7c0b72cfd99bc47eee769df59fa33e0ec56f688de6be8aa35a5fe05fb066d44b72784801cc07470db0711991

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 679eb3dfd0251158bab333bd23954de8
SHA1 58dee680562776d81bd987d44290a7acd05f7afd
SHA256 f624ce621cda10204452b08070bf3c79ead30d8d9a83d898a349ca1f2068b88a
SHA512 b9743d5044df8245a63da8a2701d6727e56236fe271fcdd8480e1496074a4ae6ee4a08ba6b1de54307c43d00ba334f0fe754b8d593063e38cc3a87cf68a151ee