Malware Analysis Report

2024-10-19 11:31

Sample ID 240527-nn1laahg6s
Target 5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe
SHA256 7fbcf60408bb7a78013b10e103d51ee4697cfa18ca2430c9eb0965c8777ebd76
Tags
upx persistence microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fbcf60408bb7a78013b10e103d51ee4697cfa18ca2430c9eb0965c8777ebd76

Threat Level: Known bad

The file 5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx persistence microsoft phishing product:outlook

Detected microsoft outlook phishing page

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 11:33

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 11:33

Reported

2024-05-27 11:35

Platform

win7-20240221-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.213.60.59:1034 tcp
N/A 10.115.38.240:1034 tcp
N/A 10.127.0.3:1034 tcp
N/A 172.16.1.5:1034 tcp
N/A 10.222.21.129:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 52.101.41.24:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 85.187.148.2:25 gzip.org tcp
N/A 10.11.161.112:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 85.187.148.2:25 gzip.org tcp
US 75.2.70.75:25 alumni.caltech.edu tcp
N/A 10.152.243.207:1034 tcp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
N/A 192.168.2.17:1034 tcp

Files

memory/2212-0-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2212-4-0x00000000002A0000-0x00000000002A8000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2212-10-0x00000000002A0000-0x00000000002A8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2212-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-23-0x00000000002A0000-0x00000000002A8000-memory.dmp

memory/2428-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-35-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-40-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-42-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2428-47-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-51-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-52-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-53-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-54-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 bf408543e1a48dd5c0a8a05a9ac630e3
SHA1 ec4e14286472826916ea3fcc2ed16d5d40e961ae
SHA256 6ba861ea5624af3ae1e5b663dd84e548e87d153759425a9478cb580e357d4697
SHA512 eaa38bfbd2c90ac129541d83abe8f9837e9bb01bbf3bc1da71fd9c521aa3db593ecd997de8559d3d474c73c092e2b3c41c3d570e6b9ecc69ed998e650193d47f

C:\Users\Admin\AppData\Local\Temp\tmp1C49.tmp

MD5 5845c25af32f70e463ce00c32f3d6b9d
SHA1 55e4ec987d68e39cfe62bfdcf389c85a39a61ea6
SHA256 823a36ea39de82b822fa902512c5e915f3494fcc4f85ae456c5980757fed39f9
SHA512 730a60348811c5175480ba140c4e7286a7936d889392448eed62db98f6fc90a5ad9e27719dc949235bef4b4872905679c77a1532e5a33fa419243a4d83f100d1

memory/2212-74-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-75-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-79-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-80-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-81-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-82-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2212-86-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2428-87-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 11:33

Reported

2024-05-27 11:35

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5fdd8b7926f7b8710b82ab087ed9e740_NeikiAnalytics.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.213.60.59:1034 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
N/A 10.115.38.240:1034 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
N/A 10.127.0.3:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 52.101.10.1:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
BE 66.102.1.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 www.google.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 196.20.217.172.in-addr.arpa udp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 152.101.63.23.in-addr.arpa udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 172.16.1.5:1034 tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 52.101.10.1:25 alumni-caltech-edu.mail.protection.outlook.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
NL 142.250.153.27:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
N/A 10.222.21.129:1034 tcp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 52.101.42.19:25 outlook-com.olc.protection.outlook.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
NL 142.251.9.26:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 coloradotech.edu udp
US 8.8.8.8:53 mx1.hc3950-10.iphmx.com udp
US 216.71.149.25:25 mx1.hc3950-10.iphmx.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 10.11.161.112:1034 tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 snai1mai1.com udp
US 8.8.8.8:53 snai1mai1.com udp
US 8.8.8.8:53 mx.snai1mai1.com udp
US 8.8.8.8:53 mail.snai1mai1.com udp
US 8.8.8.8:53 smtp.snai1mai1.com udp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
IE 212.82.100.137:80 www.altavista.com tcp
US 65.254.250.102:25 mail.burtleburtle.net tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 burtonmail.co.uk udp
US 52.96.111.82:25 outlook.com tcp
BE 66.102.1.26:25 aspmx.l.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.250.153.27:25 aspmx2.googlemail.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 mx2.hc3950-10.iphmx.com udp
US 216.71.149.25:25 mx2.hc3950-10.iphmx.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
N/A 10.152.243.207:1034 tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
FR 172.217.20.196:80 www.google.com tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
FR 172.217.20.196:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
US 8.8.8.8:53 mx.outlook.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 mail.outlook.com udp
FI 142.250.150.27:25 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.outlook.com udp
GB 40.99.201.242:25 smtp.outlook.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
NL 142.251.9.27:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 coloradotech.edu udp
CA 45.60.205.133:25 coloradotech.edu tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 8.8.8.8:53 hachyderm.io udp
BE 66.102.1.26:25 aspmx.l.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp
FR 172.217.20.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
N/A 192.168.2.17:1034 tcp
FR 172.217.20.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 172.217.20.196:80 www.google.com tcp

Files

memory/444-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1220-5-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1220-14-0x0000000000400000-0x0000000000408000-memory.dmp

memory/444-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1220-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1220-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/444-30-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-31-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 f9831a0b8b5d920cb297dce438fc8c4e
SHA1 b04ad560077a7deeb90f4c8ef9b53d54d8478989
SHA256 506c359c9781c9ccf31a516341412c9bc48830f0a62dbf48074e0c2e8bd268eb
SHA512 109ef4273e12f41d2eede95185470759ac3a29861d000a485dc422a0bd634f1a2815df8dc985673d31f5b6424a8d70235055b6f536876e33bb7541d369ab69b6

C:\Users\Admin\AppData\Local\Temp\tmp3006.tmp

MD5 839850d73e90d2ca0f5504c63e873d9f
SHA1 912b93c680b09a6b5b274d14e4b1575d9325252e
SHA256 8483442d213824e423ff95c7f1650e99e87a9d8f653f430373413a14715f3ac0
SHA512 2627d680fead0efd30c3bda2a3f554aa2eb8f2957238143980fa594c49ba12c4cec0abc0f7ecbdb4ed5435155e00d1c208834cbc1b6b4949245387531eba7513

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\9Q331G06.htm

MD5 6df7aa377289a957fa6afe08d5cba470
SHA1 325a353ff86a35ec8f98d7ff6211986841689cf8
SHA256 70f00ed614add04d2e251e34b9bdf7e2f6688f56bad5c62fc2a631a42ba0f540
SHA512 e382b00cb486b9645b765097b201b143a653711667f51b468276562e0832398b161163292dc1d35d4bb1d4b4886cbcc3fe1f55ebeedfa4549b64a8aa1afb8ca1

memory/444-119-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-120-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search[2].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\BUABNB1P.htm

MD5 1076dd3bfc15493545aec07fab7ac1a6
SHA1 9962c40c11ac51337521cb66877f251d9114e4c9
SHA256 a6c05ac00d84c2091a40c3ccb6f02f4a0cc15b7f29b7f46955484c0f4a41cd74
SHA512 7ba00cb286d7b5a68b7812af9cc1265795efeb064c51f81b04c62bf3b806c4c6514e26353a1ba216fb1f81b3eab6d93294eea80819d0394f020f006f8ac1792e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search[4].htm

MD5 d03a6e21eccee40d75cd01f57f09ebdd
SHA1 77225d7ae0133cfffee01de27ca4f851f0c314e4
SHA256 82a5940570ca81d5effc9f42192061413ecf14d165f6f439f80c65083ade4789
SHA512 a8be66027520be7516deeceefbb6da2352f7b8917e589c15ef69d4a5e03a8dbe330ad815f644ba6b4bd93ed889555c41357765203e27fe67a34c33215d501f12

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search[7].htm

MD5 db17852ac1ea7a2e8d7e37bd123af515
SHA1 c6ce82bad9d9dc77ff9d37c15d3aa7125c1ceceb
SHA256 e9b24d846697be9ae3b5da4baaae262c04943df5ea236834dba9a5a308883a60
SHA512 8a363226fca3250bbb4d827f283f7344fac7c09b4c1b97a65b18c9cd1dbb14b3374c79a2dff6e593d10a4cbd786d85c282136728be2849d37067c982a9e4b05e

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5df23b7cdbc3abb17bca117f17476aec
SHA1 6ec631c0709f0a541cb48ca805042baa2570d254
SHA256 b19dcf6370c46f54483fa89f20c1ecf18b310f143a9a8085e6d68c086ef92fea
SHA512 6b0e3eb9ef4770329919e1e44b50409b8367a2065ebdecf11e7598246d312b448b82db86bf13ae7605deeb8be309863e9c3bfa0a0727b5fcb772fff6e61cc906

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search[10].htm

MD5 a6d48a43c2f32edc74a57edb1c1d37f8
SHA1 bfadbc2e4d9a4bb333c8e987ed8a9e60bb0791db
SHA256 25aab7f6660d51c5f6f573a1a74becfbcc9f5a6256e204f80df54edd8f2d73cd
SHA512 6481feaf0db4d493aacd34f1f5b9bacc79b532cb822e825c5fc4e6dbb4877e7822b89b1208311f6e0f5d7f1f26298cfbb0a1d0366673936f64f32fd6a79d4b8a

memory/444-267-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-268-0x0000000000400000-0x0000000000408000-memory.dmp

memory/444-271-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-272-0x0000000000400000-0x0000000000408000-memory.dmp

memory/444-276-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-277-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 03e0bcc0b5fcb225d6c27d28559b5bdd
SHA1 b2162d24a7717a6daf712dd924a676eb9ec3e649
SHA256 4c7fc29585c49918cbe117215c5f9144a082b9191489ffa295193bc797f5e872
SHA512 0664ddd4f74b97991ec7fcd314b6536c4ba20c0faed4a4456aeb621ab58ae46fcd4b1a8b94b1f1e47e59cd5c5f7012b77a14a4407791ed9f40192b4c99705fe6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\results[5].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

memory/444-308-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-309-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\search[4].htm

MD5 5b4fb93e5461c798eb5a6183e4d41156
SHA1 c5d0feeae5ae43d7fd56164cf3c7abc227b4dc16
SHA256 a90b60188d01b91ed70d49255a6bf2ac416349687f626c5e3fdf5a2d3ef36bf5
SHA512 043e045116c91a2e6782760283eb6720241b3a8482d0de40d99a60176790759ee43b13cde7527466acf55a764df6739d514cea0c59e9d70266be32854045816a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\default[2].htm

MD5 14b82aec966e8e370a28053db081f4e9
SHA1 a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512 ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search[10].htm

MD5 e09b00111d88189cdd4f91ff93337b89
SHA1 593744b5ce694c82391d14824c36052c3f4ef0aa
SHA256 2f3426714b002ffd35764b2db146377de99b5e5db233d32cb2c4a1c4988e57fa
SHA512 cd66b820ce904de5b47ef438978e09fadf68d3f3540912985d5151094919b7d7a2d3465f397fe30d332f66e694acff38f21ac948ca0ebce0c4ba33bdb7752ef7

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 177406093bc129752e9bc6a34ea1b4a5
SHA1 90cd5f6cdcf4a5d43dadab2065dd293aaa741956
SHA256 cdf5cdede41b12a072a88a7f1e94a0c4982a80a69fbc2e9990e192fad74f7dfe
SHA512 08ede580f151e8152d7f9519ca2f3b22133cee528bdc3a7dedaf97cabc2add16b41b253facba92945615825736fc2ea13f38940bda2ce393e4a7547ffbe809b8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\results[3].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

memory/444-383-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-384-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\searchVZVEK9YD.htm

MD5 5abdb9b356c375f4d05c403e46e7e297
SHA1 1912dbffd7d8851a693f6e18e360dcba69a225d7
SHA256 e0e87f38604d713a4867e99d072627dd414a9c02dea083f7fb8d0388c45dcebe
SHA512 2f978be56fa2fa6f3c61dc40be0d0d95c9c03b2d8c1f418eea9ead1275f9b395ea347f219f84b297aababf2a360b9a214e3161501f1c06aaea4af1f0bcfd17a4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search[3].htm

MD5 e177405c566e2dd4fecb3e7dff58c9fa
SHA1 54e656dc934e62d51c78ee247cc7ead0eab0ac38
SHA256 35f04e3cb6e8f2df5cf4cdbdd0655ffaa35596d7a8f915336ecca6769b097aa5
SHA512 95778c45f558be5d72cccf62be5514e881dca6f21bf41837a672914e514aef5fe231ecea84ee1383ea84da3692cea993ca1e69b978ea8b6172b21eb84c2157ec

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\searchP1GOW3FN.htm

MD5 dcfdb7f9480fdf3590696a64fad4c7fb
SHA1 ac14d0a99abb4acca82e7cab8d32a95dec250c78
SHA256 1e4ff24556d78dfa46059f8017c4c64b4755a23b2fc2262b266bc93c2ed4e325
SHA512 88dc92afd4a6abdd6a62470d3da706dbeba2abf3cc9557e486ffc6d059d19e678d2dfe5c44c435c9408013e10aed565f09040e9820f5a869269737b5c298650f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchYHOTB3RX.htm

MD5 53f963911aca7eaa00d2e95b89fc0981
SHA1 61ddb42fb997adcc25365694dfb70b4561469de4
SHA256 c4ba6f01c135d2354c3169820accd463345fae04e50a57704a10f59e24a7d95e
SHA512 051364b34251e1a4ef88ead7c1863d520979de1de2620c9554af66a124d812dcf1bcc42149d8e1b8c11a8a5af31173bca58e9f24b9eeac391ff0569c2a0949b3

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 0a2ab0a30211d5f33c3675ce73fb2ed2
SHA1 08cda281adf9e2ae92cdebfca0750aa2755add19
SHA256 8cbed193c43ccff84a377f5713d5fd93ef0bcf13c2db4b64b3c548c5e4959690
SHA512 d1d2fe6919888a6523a20d4a19242d115115aeb0185c808e02495c5291a28cd5de4d1e79ba1ae73d5dbddff3b78f96f8cb5bef48b2cbede5622905c3661c2e79

memory/444-589-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-590-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\searchIC72SYS0.htm

MD5 78f7f30b40b8ab1ed6864c71233253c1
SHA1 49a57468ab010d74a4d6c0c858b61e1e6ecc8981
SHA256 493ac998f8ee3758ad613c48ccb7589207360557bd5a60d762135671e7c44bc8
SHA512 ff7554a8ffa94bb23839feec865fe0f1d0f07e58369b5f61ae023239285793451f4546efe51fb5fcad7bbd435e7f59cd6bfc9f4d82186e9da8086343a787fcd0

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchST72UZ0G.htm

MD5 2b96a3e3110dea2059f347a2e99c412e
SHA1 f0cfde4aee7b724833fa0aa7afad0e8271373d7c
SHA256 35d65df9df188130a77f48d2737fe2b7709ed5acece455b7d39548e1995c6765
SHA512 27f23e15ff0704e73b72dee378a831e7bffbf45619108f375437cf3c395397a39c2d0ccec54be1e790ba76e30157b7a30bd21e6d524c480b55951af32da10811

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\results[8].htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\default[5].htm

MD5 2a8026547dafd0504845f41881ed3ab4
SHA1 bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA512 1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\searchSENH02C2.htm

MD5 7d90426277b58fd0d50014d7bee36ec3
SHA1 29266b105a70c20a71305f41b0901e29f68802c3
SHA256 5fbb81686f42fa7d948f01f1186a4a32f89f4395deb0b9bd498e52455f1f744b
SHA512 01b3aec47a9b61cfc3f7c6d9cb87b31559ecb2a8bbcdc9ea66d2a53efcdcfc0382cf3577c3c5b349607a12abb58c3a4c98fe441148aed44fa5de4b9bfb93cdf9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\search4VW15OWV.htm

MD5 b070501bfa7e81411b074086cdd014c5
SHA1 d6feee0022ca602162fbdead3a2bef22f871cfad
SHA256 9b5acb75f727e7025103cf4120ddcb338efbd9ad18d8c48ff0cd8ab5c2350e6e
SHA512 19c75d06eea9ec8047a3a83c2ff8b9c13d9469cbd28f0d9924bf784a7507a29c98837a83132bc9b6a86a27fb28b26b5cf11a2df7533ae555d4ff2032649576da

memory/444-729-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-730-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search96N4Z6XN.htm

MD5 790155157dafd39e5e10b33d38219496
SHA1 ca73c8b6a75abe4fcc5b866b1fd6d213c8dd939b
SHA256 7b3a26b7ff61c11e4e441398a7481d2190c9ffd045d2c76a8b5ebd192b36b10f
SHA512 6d4b95ea5d856562e407bc9574a9129b0ce2c4496dc5da84b52ce5650e477cfce6003610aba5ce63cf7841725374d5f9afd2123c6c31cf1b3e3767e98dfb38c5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\searchU42J51BX.htm

MD5 4e1e5e799fbb56420dfc63910e9cefb3
SHA1 da33267d546b65fce1c01bf0c6602eaae0556b99
SHA256 60dcedf780262a68edebb718ba6227c7f00dd01229618ae14fcb71085d917107
SHA512 79ffc1903e00d244e477a4f68f3b7e5b1313ef2d5c8a74c33c2e06a92521914060f7fa13ab880b9f698c80dde0e3dbebebb9bd11c2e9d871ecf79007aad8bc5e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\searchNBNN16JD.htm

MD5 b822720a248e4fe1aa7e4b20e0f4e571
SHA1 b7b1dbd33df26c5b2883b382671f3d1fb9e6618f
SHA256 72ed67ca91198c0f256878c5f359d95b7c5b3b2e4ed5b80d9c4690e2ba3aee93
SHA512 d62b7ccb3774f546a6f06c75756e8aa573b2137b11ec6c156cbeed4c7ad73e33e1ccbdda6e4f90f93d6d79884851b043fb5f32200d8a576dc2388b3aae2bb2d9

memory/444-923-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1220-924-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search9NR4YZ8K.htm

MD5 cde52a139d79c647e1ef512a322234f5
SHA1 0745f292d43b9c74194f79278962a4c584341aaf
SHA256 c0544684814b3f8967a5611f962db00e724e262eb88c6eeab4b92fac9c797c06
SHA512 525a281ae90105d0f91673b0e024de01ca4785f32d8de65e1f11375c3eed5cac4569e5626e7ef6bc92522cbe1098471e415893d91a16bb388e1ef0298715d8a7

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 515f25fc78541affd7cc41735bf5bf48
SHA1 07e4c473726be607b82b855c7bec48495c1f3ec0
SHA256 9be1f80778957f53830c348ddc8c0d75315a9eb42e978e559c9bdfb7265c3185
SHA512 063257634275cafd25ef022afddd73d92894a78b0807f1a6379b57dcbc53d2266069e44986644e04ede449c3232dfe45acab000b4503dea1b141b6de7fbfd490

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search6HWUUELZ.htm

MD5 76d8a4df0b1b06e7dfb8f4aa690e944e
SHA1 0234590b03027ffd87b6efdd531516f01bf4e3f8
SHA256 8c8c5a6e8ea303d9c031b11b0afb1e6856ec9e61a1147d1ab9cd45f087c4d0f8
SHA512 a76e38b6844dc4b0b970967076f8e495a8285c5ce1078f074560909027394947db4e3bf9052392649c9d25c83b55f274102ba06a6b754d49fade335a535779d2