Malware Analysis Report

2024-12-07 02:57

Sample ID 241110-l2m61avejd
Target a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N
SHA256 a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461
Tags
upx mydoom discovery persistence worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461

Threat Level: Known bad

The file a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N was found to be: Known bad.

Malicious Activity Summary

upx mydoom discovery persistence worm

Detects MyDoom family

Mydoom family

MyDoom

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 10:01

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 10:01

Reported

2024-11-10 10:03

Platform

win7-20240708-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe

"C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.156.133.4:1034 tcp
N/A 10.127.0.6:1034 tcp
N/A 10.152.243.207:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.9.24:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.9:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 10.202.221.84:1034 tcp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
N/A 10.202.221.84:1034 tcp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 mx-in-hfd.apple.com udp
NL 17.57.165.2:25 mx-in-hfd.apple.com tcp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
TW 142.250.157.27:25 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 udp

Files

memory/2052-0-0x0000000000500000-0x0000000000510200-memory.dmp

memory/772-11-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2052-8-0x00000000002A0000-0x00000000002A8000-memory.dmp

memory/2052-3-0x00000000002A0000-0x00000000002A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2052-17-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2052-18-0x00000000002A0000-0x00000000002A8000-memory.dmp

memory/772-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2052-32-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2052-37-0x0000000000500000-0x0000000000510200-memory.dmp

memory/772-38-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 a912b545ba93253d04704a7736b8fd20
SHA1 6c7d76470f72eab4d2abf7c6d04049792674e33a
SHA256 4b10d5d361360802d749badb8fed3f59a9e9b81a6089d6870f9408f3956c3238
SHA512 d2600391ac633e7810d0b80fdea7796a0fef6ce4710efb9bda9fe690b898d6eed6245ea0a85a041ae42a0a13ca6bd4b689f116a111e26300cd5e578187d81836

C:\Users\Admin\AppData\Local\Temp\tmp8D82.tmp

MD5 859b9f021b31154d01e0b9971a2a2199
SHA1 228f8a41e6c53fcd6c8af97eb3f738eea0f001bb
SHA256 ac698514cd1c394a6a30db5b55bd0723d4b6099b1d329485b0930fffcde17d2a
SHA512 994eb57c2557648733e136a664219d31b808e881ca88713976fa65b9f007ffe95305c3b07c254ad85247d17a6b5c78533608864505df9d4108eb1c231c15087d

memory/2052-58-0x0000000000500000-0x0000000000510200-memory.dmp

memory/772-59-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-61-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2052-60-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Nqje0.log

MD5 28b9a71aba8424f95c37c5b2f80d9858
SHA1 dca7f215a72c150a53ff65942298d53e41db81ef
SHA256 4c166f859f1c64e118a9b2857161e990a4800e6e75060f988f4647b6f69af903
SHA512 933edc4301b874dceb5e63b79cc7dbb7bc5a0c2c6d3cf6321f45fdb61321faeb5440b80a1e3e94bafea3a882666ed11629f75f11105ad8e2f6f78334cd9ac713

memory/772-66-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2052-65-0x0000000000500000-0x0000000000510200-memory.dmp

memory/772-71-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2052-72-0x0000000000500000-0x0000000000510200-memory.dmp

memory/772-73-0x0000000000400000-0x0000000000408000-memory.dmp

memory/772-78-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 4be1bd7ae0e9f0c29d9fb9902cab63d8
SHA1 598bc2d69d1b3c800ad6b26b25603a66f38344fc
SHA256 917a9ac2665487252aba435cc25849c11ca956607cbf5568d83bf5d3d1888879
SHA512 b3cbeac8940a6938816d8fca6ff61f3973c316b227edaf562ea142091a0372b62f0180612c503a0b7a21f36a4afd4025809d18089e443e6e72842d39114b1fde

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 10:01

Reported

2024-11-10 10:03

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe

"C:\Users\Admin\AppData\Local\Temp\a79d2b306a86fdaee4c32100bb94f387d5c397af0b46237fb3300ea5e42b7461N.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 10.156.133.4:1034 tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
N/A 10.127.0.6:1034 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 10.152.243.207:1034 tcp
N/A 192.168.2.9:1034 tcp
N/A 10.202.221.84:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx2.googlemail.com udp
US 8.8.8.8:53 acm.org udp
FI 142.250.150.27:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 8.8.8.8:53 cs.stanford.edu udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.8.32:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:80 www.google.com tcp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.23.210.75:80 r11.o.lencr.org tcp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 75.210.23.2.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
N/A 10.202.221.84:1034 tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
GB 142.250.180.4:80 www.google.com tcp
US 8.8.8.8:53 aspmx5.googlemail.com udp
US 8.8.8.8:53 acm.org udp
US 173.194.202.27:25 aspmx5.googlemail.com tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 104.17.78.30:25 acm.org tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp

Files

memory/2116-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2216-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2116-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2216-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-38-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2216-40-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ciwwh.log

MD5 dbf816795c868a24b458472e7a4aa9d2
SHA1 bd49001893fc2fbb8b7ec1d452737e95fa1e51b1
SHA256 34781a2ce7b6f9848e99da49c283abbe1116c73e7a713676cf585b9a9725ce8a
SHA512 73ad238ecc52fc7c54d25cf3f2edc60bf0eb1a1985381d865cecadb2e46acecd99c62477fec88a3434a4ec59f8397abae349c22bb624ee11862a357673fb5f9e

memory/2116-44-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2216-45-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-46-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2216-50-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 4917889c5fdfb5ae523de0c8aaa819f5
SHA1 a466ec43eabfbff9909b30c534c3ff35367bd1ba
SHA256 04c14cc4e32433affcf3f307ed04e91fa9a698722a7fd659f01e5e218a585d6f
SHA512 b41da1c46b9e75ad2c19aefa51ba224e18d18110a4f558a6841e01e019d2194ae0857f89af35ffc649f69d38fef99ca6bc707d00ce22bc4907c6c7884d8a570f

C:\Users\Admin\AppData\Local\Temp\tmp1FE4.tmp

MD5 4961f641edfaf726a08e51c99db510cc
SHA1 827fab796b134042da15cac8286dc6deb8634a3c
SHA256 0599230060b5cf9062bdbfa7d4bb69e9b967a4c10a6a6b92d6b6a8bdf4d264ca
SHA512 a257644875e63bdb66fe46a16c5d9d0fe7d53977b429f4830a6d5b5674c74a1d4f27cc506e0a6154484aa30bcb61fe6dd7ed506f173b25a7273b4dd772bb87f5

C:\Users\Admin\AppData\Local\Temp\tmp20A4.tmp

MD5 f2eff6cbabe780f86841c1c76a762e29
SHA1 fc020b38684c622b9faf54162634b051da1cc103
SHA256 75c6a7fd79c063fe0ce6fccdacf349e9eb9f015b17b1b242e349f765c27fa776
SHA512 c8a2cc80e9931c9e47a7c9bd52bec6d4f77779fef1fb8d2fc5295d8d02e709ce4ccc8648c598c33158c7da86991521b64bb611cdd0af703855f3d760946bb545

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W9QJOIKH\search[2].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/2116-145-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2216-149-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-166-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2216-167-0x0000000000400000-0x0000000000408000-memory.dmp