Malware Analysis Report

2025-03-15 00:46

Sample ID 241023-l18fjswapl
Target c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N
SHA256 c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0
Tags
upx mydoom discovery persistence worm microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0

Threat Level: Known bad

The file c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N was found to be: Known bad.

Malicious Activity Summary

upx mydoom discovery persistence worm microsoft phishing product:outlook

Detected microsoft outlook phishing page

Detects MyDoom family

MyDoom

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-23 10:01

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-23 10:01

Reported

2024-10-23 10:03

Platform

win7-20241010-en

Max time kernel

120s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe

"C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 172.16.1.3:1034 tcp
N/A 10.156.133.4:1034 tcp
N/A 10.0.77.20:1034 tcp
N/A 192.168.2.155:1034 tcp
N/A 10.128.8.216:1034 tcp
N/A 10.127.0.6:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.9.12:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 udp
N/A 85.187.148.2:25 tcp

Files

memory/2116-0-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-4-0x00000000002A0000-0x00000000002A8000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/760-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2116-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-17-0x00000000002A0000-0x00000000002A8000-memory.dmp

memory/760-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-37-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-42-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-49-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-54-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-55-0x0000000000500000-0x0000000000510200-memory.dmp

memory/760-56-0x0000000000400000-0x0000000000408000-memory.dmp

memory/760-61-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 3c04fe537f69c4b097dd2329e8b3fe73
SHA1 710fd9100e45ecacc6b922df758c23d3907085f5
SHA256 7357dc71ea5d7ec755ead5dbe15bc236a66e705f020907a56e3d45b4bb3a3627
SHA512 73bfeb210f4f73727acfd9f5afed945ea794d96c10780d12f5f997a312fe4f73c9f7c9c12358599a437fc724d6827c59d5730c1e0fcd995c5ff1132de3aebbd8

C:\Users\Admin\AppData\Local\Temp\tmp6D73.tmp

MD5 de71da31385426a6fbee9ec0b778dbcc
SHA1 9af82e91fcb0a6f5c70cef2867184b9037e81bef
SHA256 51abbe194094bc74a246ee3f0e7de3492f991c2e0b1003b40dc4c12a96870f39
SHA512 7325a51fee2e14e20c1d422fc47f28ad6e2190f56eed9908490581b0f403c4ad38531688f4de5ce71ce1ef19381a033367c6174d92592f998a0f4ba1a097ac72

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-23 10:01

Reported

2024-10-23 10:03

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe

"C:\Users\Admin\AppData\Local\Temp\c58e1da613127a7c9357f945a8300923678e7ffb647e0b44c0223c5e5c4fa2e0N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 172.16.1.3:1034 tcp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 10.156.133.4:1034 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
N/A 10.0.77.20:1034 tcp
N/A 192.168.2.155:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
GB 173.194.76.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.11.15:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.36:80 www.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.73:80 r11.o.lencr.org tcp
US 8.8.8.8:53 36.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 61.45.26.184.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
N/A 10.128.8.216:1034 tcp
US 8.8.8.8:53 aspmx4.googlemail.com udp
US 8.8.8.8:53 acm.org udp
FI 142.251.1.26:25 aspmx4.googlemail.com tcp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
N/A 10.127.0.6:1034 tcp
US 8.8.8.8:53 mx.acm.org udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
DE 142.251.9.27:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
IE 52.101.68.13:25 outlook-com.olc.protection.outlook.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 8.8.8.8:53 mx.gzip.org udp
GB 142.250.200.36:80 www.google.com tcp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.200.36:80 www.google.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.200.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp

Files

memory/4916-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/4988-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4916-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4988-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4988-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4988-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4988-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4988-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4916-37-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-38-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d77eec548d89bdc9845f339b97f5936b
SHA1 8774781a8399c3470f208ade39c03b4077def83e
SHA256 c3337c29b862e2251787a7a4ca7c4e9ce61d176ef2022724c62b742b5cd7f36b
SHA512 2727b6ba5381b33cfeb4af745bdc62a2ece45175fd69e5fda77a3f1fc947d6285b07db63418298842f465db528c26c944054093634451613a0d38d7e216cf1e8

C:\Users\Admin\AppData\Local\Temp\tmpCC82.tmp

MD5 841f2a6808b3e65cef62be940e73eca0
SHA1 2cb0c6c25f58e6f2ae6c4b8d3179328f633b4916
SHA256 c8fb4d325a8c9195a182a9fc067029372e4c2df2278a5ee1025552b317af5d24
SHA512 ee284b5e7a42a3678547233d9806366e7224f72e76a8868fad3e14667515377ff9aadc3f45872969c2ce4e8ee612d61b7c36df7011dfa7f0213d0967696b09db

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\search[1].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/4916-113-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-114-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 adfd0a20352b24729dc1c91552347580
SHA1 f0db09d34b8661c50c0683d45c558ab452b5d04d
SHA256 b7cf5f3869d0a204b256562e65a6d785b269b8a0d03262e0eb8c9fec546aa6a0
SHA512 64a770866289d1288b22abf92f5470a267933c4ea531ceec417908fb9bec786f86d7b54161bff74eff4ce8862a56ee85fa84657103aac0218c40c5c195818a0e

memory/4916-150-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-151-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4916-154-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-155-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4916-156-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-157-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 3f908e01be17a7900126c21e44d40ba7
SHA1 d12c2f54e9f4c90c9778db6f5712c2610fecf533
SHA256 4cdb5ca81461a298f18dced758fdc57f3a6c4046374c648d320f396f5b1fe0b0
SHA512 803353a10b7154b0b7f4347117c16a40bfc41c942c56b5f6fbc6ada73ee333ada1bd0e3e5e78cae59895908327fed617b896b7dc3ff72a34eb88c282cc06982d

memory/4916-167-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4988-171-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\default[2].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296