Malware Analysis Report

2024-12-07 02:56

Sample ID 241109-zc5awavjgp
Target 46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N
SHA256 46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42
Tags
upx mydoom discovery persistence worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42

Threat Level: Known bad

The file 46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N was found to be: Known bad.

Malicious Activity Summary

upx mydoom discovery persistence worm

Mydoom family

Detects MyDoom family

MyDoom

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 20:35

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 20:35

Reported

2024-11-09 20:37

Platform

win7-20240903-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe

"C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.156.133.4:1034 tcp
N/A 192.168.2.16:1034 tcp
N/A 10.152.243.207:1034 tcp
N/A 192.168.2.11:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.10.14:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 10.202.221.84:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 85.187.148.2:25 gzip.org tcp
US 204.13.239.180:25 alumni.caltech.edu tcp
N/A 10.202.221.84:1034 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

memory/1956-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1956-4-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1956-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1956-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-37-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1956-41-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2512-42-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-44-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zjg9emFVcj.log

MD5 de919b27688336ab79af902634017368
SHA1 65aec1d9967bf93b6a240aaae170db5ba7bc7313
SHA256 91f2196f278c4597fc7a48901c3cc49af5cee4c9cde6ff0145c7a7f8cbcb9241
SHA512 7afd078302fb29dfeeb37346291c1fe58999ad7a0941033c996895ad7d02a15724820b4c908bc92e725da581092ea8cc94117534a21cedd00af2dd9b0c3f8fb9

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 ac64f65155c37e2151dcbb772583ca34
SHA1 8e6f7f23a41eaeb16f1d201f16f8ccec2e4197ab
SHA256 a7505854aae5410b29bbd7b80150c3d24d20ab2531285f6870a3c248e6388793
SHA512 2b28e81b2165d18085e2110cc15fb300e3a86c1084baee43e1b30534c8a9bac57a44abd9a32e7f54e5fe8c193f4393c99d7b6cced40a79c7f88075361cccd2bc

C:\Users\Admin\AppData\Local\Temp\tmpF99D.tmp

MD5 35436ff3aad289451d7bff9952d68194
SHA1 b752d90134012a6dd8168b2de6bebb2f8a6b4583
SHA256 9a9b3e898538546f4810af016b1ea308854f2e3993d84ef5494ab629f51e95d1
SHA512 b213a869a12bbe60507fb40309d4e02e8014fec5ab1fc60d3ca78f6c1156da339c763c6163e2bc275d7f352b73251c81f2661886083705bfb3dfd0ec8f1ec66c

memory/2512-63-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1956-62-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1956-66-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2512-67-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1956-68-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2512-69-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2512-74-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 20:35

Reported

2024-11-09 20:37

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe

"C:\Users\Admin\AppData\Local\Temp\46685671b783c6b1c15f57d8a6e316f1c35c36d616c6e9534c1bd292eeb43b42N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.156.133.4:1034 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
N/A 192.168.2.16:1034 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
N/A 10.152.243.207:1034 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
N/A 192.168.2.11:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx2.googlemail.com udp
FI 142.250.150.27:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.1.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.51:25 mx.burtleburtle.net tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.10.16:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:80 www.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 8.8.8.8:53 www.altavista.com udp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 142.250.180.4:80 www.google.com tcp
GB 2.23.210.82:80 r11.o.lencr.org tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 69.194.219.23.in-addr.arpa udp
US 8.8.8.8:53 82.210.23.2.in-addr.arpa udp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
N/A 10.202.221.84:1034 tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 aspmx4.googlemail.com udp
TW 142.250.157.27:25 aspmx4.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 10.202.221.84:1034 tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp

Files

memory/4672-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1548-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4672-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1548-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-38-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4672-39-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1548-40-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kcwaEvxwxU.log

MD5 0de2cfe14f9496a75a4a3ea8f93babd3
SHA1 f004bfcadd758d38098e4653267ef18cd43d9b26
SHA256 742c2ddae8c646a43b4832ec5ab68dd34e23e484d70bd3aca59b9fad6e621a24
SHA512 3d37c663729ee62cfd14034959b8c84f5345e821d7acae70179395329a9a42aef35ba11308c2ddbc65b79e9b397b36a7c69936d2ae204688a6dfc05622d501c5

memory/4672-44-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1548-45-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 6702e2a306675db2d15087181dfbe53e
SHA1 0c486658e4025d1181e0328a049bb0b6e16ddceb
SHA256 7db28f839fd61cbd1dbbc4f1c292497cfc5c33a872d90e03e9f05d3181c5966c
SHA512 31901556463c75058d8bb4a9552518e1ca74b8fe7ace1f10266835a8fdd60eaef3ea8300db96080411bb9007101b49ef57652774cce7008ebaae8b05c254b2aa

C:\Users\Admin\AppData\Local\Temp\tmpF896.tmp

MD5 16ef2b5c21a6d43673d97c4aa0091e93
SHA1 abb67df85d565543e34efd9d75aa06dc34239136
SHA256 774a6291f6f7f9f639c845b185fe97e105739f1ca822583f489cae9e055fb514
SHA512 b96219f905d999b79b86885e565403724401cb0c3f57abd5b91a545431edda6a4637ee1a11fbc93857875de04445e15d02d6dab4bff361864ee7c8e90d4a7a71

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAZ6MGFU\search[3].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/4672-152-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1548-153-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9PMCFZKU\default[1].htm

MD5 157431349a057954f4227efc1383ecad
SHA1 69ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA512 6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 b3c7bce6d709adba39d87b2221340995
SHA1 4a82556ec3be22234ae466e0f0be17e46fa466d3
SHA256 d2ceb1ca35dd2e66a377114ba2a9a624c425cdb769007d701e2ff15f124cba58
SHA512 882ea9942de0fe0c58db4cd02cb8932854c20101fe68f6e05ebfdf493865f7f3ee238662be95f5bf6aab9bdea3cedaf881fc42f143dc899d5a41e1e969399de9

memory/4672-178-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1548-179-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1548-183-0x0000000000400000-0x0000000000408000-memory.dmp