Malware Analysis Report

2024-10-19 11:32

Sample ID 240527-zsh3ksba48
Target 7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118
SHA256 84a63bec3ac6c69f8ebcd6ca3baa58a6c69884d5e34e673031e919f91d742ab3
Tags
persistence upx microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

84a63bec3ac6c69f8ebcd6ca3baa58a6c69884d5e34e673031e919f91d742ab3

Threat Level: Known bad

The file 7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx microsoft phishing product:outlook

Detected microsoft outlook phishing page

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 20:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 20:58

Reported

2024-05-27 21:01

Platform

win7-20240508-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
DE 116.203.110.42:1034 tcp
US 15.130.71.190:1034 tcp
N/A 192.168.1.26:1034 tcp
N/A 192.168.3.65:1034 tcp
IN 115.245.236.35:1034 tcp
N/A 10.28.0.151:1034 tcp
N/A 172.30.13.81:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.194.15:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 16.69.10.81:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 15.255.173.249:1034 tcp

Files

memory/2236-0-0x0000000000500000-0x000000000050D000-memory.dmp

memory/2236-4-0x0000000000220000-0x0000000000228000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2236-10-0x0000000000220000-0x0000000000228000-memory.dmp

memory/2084-11-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2084-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2236-22-0x0000000000220000-0x0000000000228000-memory.dmp

memory/2084-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-27-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-35-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-36-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-40-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-45-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-49-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 025977b15d8ca6b9e90c7b4a52138327
SHA1 63e51d440309cf41026c0a26d9f1796aa6a5dc57
SHA256 d8bae8cd7f0165c69d33aade35e95d784fce1a106082fca46e0970834c189faa
SHA512 4c52a1ff1517143cf7c204ec4008d85ec48f54c81f080effc432e75ac488b578e648dd065abf44cdf5f86336b88a49d2c51db579f159d2e95c89c8b4039b7cc0

C:\Users\Admin\AppData\Local\Temp\tmpE2FF.tmp

MD5 09265c714bf124a98a9acc14fc0f0bca
SHA1 08b847dd13119a24aa07c3c5f68a6d8760a409a6
SHA256 7a44b58de8dc12764587b678bbbfff50f01213ad7a459e67d215b26a3f8a05e4
SHA512 a2d0bea18b4bc0e5f0d40040334ae8c908caceeeea7ada7257a05aa0ad81748724a1f491c22d6da22089d0be018ca568c13f009458cb155e096091c421e770c7

memory/2084-66-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-67-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-71-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 20:58

Reported

2024-05-27 21:01

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\7a8247c355408eec79a0c0b887aab8b0_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
DE 116.203.110.42:1034 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 15.130.71.190:1034 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
N/A 192.168.1.26:1034 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
N/A 192.168.3.65:1034 tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
IN 115.245.236.35:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
BE 64.233.167.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.194.0:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 www.google.com udp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 search.yahoo.com udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 36.215.58.216.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 170.101.63.23.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
N/A 10.28.0.151:1034 tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
NL 142.250.153.26:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
N/A 172.30.13.81:1034 tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
NL 142.251.9.27:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mx.acm.org udp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 cs.stanford.edu udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.41.22:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 52.101.41.7:25 outlook-com.olc.protection.outlook.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 16.69.10.81:1034 tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.250.153.27:25 aspmx2.googlemail.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
FR 216.58.215.36:80 www.google.com tcp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 65.254.250.102:25 mail.burtleburtle.net tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 smtp.gzip.org udp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 outlook.com udp
US 52.96.214.50:25 outlook.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 8.8.8.8:53 hachyderm.io udp
BE 64.233.167.26:25 aspmx.l.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
FR 216.58.215.36:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 tcp
IE 212.82.100.137:80 tcp
N/A 15.255.173.249:1034 tcp
US 209.202.254.10:443 tcp
FR 216.58.215.36:80 tcp

Files

memory/5520-0-0x0000000000500000-0x000000000050D000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1056-5-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1056-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-30-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 18ae00e6a06ec48ee9dfd18bbc07c038
SHA1 d0e010216f738d00999d66a3854e079d4786d18e
SHA256 2656d9b72cf52be5842d47d6ffa6aada8e7dde8642f296ba173de3cebc1096b4
SHA512 2ebd9ea525b70e2e7d9231990e6f4e5754a9b505f67ca732458f5985c56a8edb5cfffd52a41e24cc7cc4c86906161a0838b3566c2ba6e8e5b901e555e7290cb7

C:\Users\Admin\AppData\Local\Temp\tmp9401.tmp

MD5 5f49becbb8d91586237cc831ea44eb6c
SHA1 d1bf53893543d34c0a8d80ed1813d566a233ef33
SHA256 507daf0b8bc6002dc3816ba92dc907e365996c62804842f89147d9f9d43d0c7f
SHA512 e85796ffa04237beb9f71d6951f0b67a48f75843fd49254af7bb1f89ae228904a1b9b9b89fae05445608a2e0ad0e4b66cc845c4294e5be37ac6d0a2a223f01f4

memory/1056-91-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\H6NIWI0F.htm

MD5 819efaea4516150780012c0da9067a68
SHA1 42c29d8e089d8db23584ed4f3681d7bf769d74eb
SHA256 0d9e6274edef3e34b06c89553f1f361b64de16356b381a5148a88db81c978413
SHA512 1beb7ffe2bdcb5e4a74b38140b23284e3fd76e153a66a50f41adf3deef6f545108cb57950c17f5d2aebd21db808eb5c4ea1e16c0ad776a50f6eaaf5dc0602660

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\search[1].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\search[3].htm

MD5 2f95d8a228d227b2a861c7d43646b6e4
SHA1 035362e2870ef52e40532d02f49841a549daa371
SHA256 154c4672257cbbe76fae81186a9772682b9497e5b77adc81672b9659080e7bf2
SHA512 58679f161b9cedee316797c221136a2b22934244f7c61af0e027f6192b35ea12bbef802d00bcb97d81751d092f7e6c986b7d39b9fd34007898864107adc50179

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\search[3].htm

MD5 cccb2c369721773186b3b228ca8dd649
SHA1 104c41cc2e7107d7b8e26770a2899b48f3ffe489
SHA256 bc4e9a3d1a2a35c581ddc4f87674cf053b77d3310e00f1b3e1993f6cc391aeda
SHA512 710ae15cd38831b25e02655684a867f40f3d503824435baa35d7aebc3d0915a9c7df188c176b9a701fa14aaa9715fbe7775de38be25aa9b696ed2303b9c5ced5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\search[4].htm

MD5 4c8d4322d597fee089c9ec9d35123e0c
SHA1 026515a76a173aeebed9d08fd1a5417d9f338fc0
SHA256 e2b072148b4a4388ec06cb902501b3058496004dcb003ff6c537cc5691e08c24
SHA512 ccbf41c639fa743069e4e791238d150bd9d0a66d32d5693315dcb60b793fa079c5684f5b71102801ecabe7d22dfc0da50b6be0827668feef002fc47f08733f5d

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 4288a3999e0a70259559b0adbf9945ac
SHA1 ccafb1de66ecaba0bc9f03dc01cfa3d583d5e973
SHA256 c96b8f76ae326ed7f27b4fdcbd3b4b5879218d26532b2c96d5cf7a298304ca6f
SHA512 639e9cf4e9e04d88d0a5a1d85f9722f98a5295ed579f4de88f4c0f74ba768b07c4f00cea385faed9be7e7f2251767d2df586184f64a29a140e05922e60c90ff1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\search[10].htm

MD5 3de270ea122229c6e504abffd82a0146
SHA1 b137cfb4edab4c31979c7c987d50bccc0e6cfd4c
SHA256 2abd8b7f3450199b809103d79c1077116e31bee589fbbf9efa0f93389f75b4c7
SHA512 026846d9139156c8a74f69af36e0df3c5f4acd564d5087f0f67627175f7ce5532a0d1d6f5719f8ae6439b9add5a069e281fcff3fa5aa2113b0acd5c144d587ff

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\searchE78N88PZ.htm

MD5 b13634000f63c04711a22a6091eb8102
SHA1 2dee37f8e44fe5dc4aa7d192a495c7b4007475e2
SHA256 90ce23831a4adf6a982aac8f867e3cf984ac74f910f204aeb53b7a4307795f00
SHA512 ab0186d3712e8acb10a0d646a47f029c2f0975d6e7551562efa2c0a6797203b2ec31abb71344cdccc11504b48a9a5f6f433c093c48c0e6e8475c7067e16aba64

memory/1056-291-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-306-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-307-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1056-311-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5f9e36aacea69b5a96018e6bbf1be40a
SHA1 4345a54a209e15583d6dacd4e161976c437c9da2
SHA256 c18361a369cc55e573b77326cc9a6b842fd5bf30e9ac596f9c39e315fe8bc41c
SHA512 a544484a1e478a9dd53c26a55e0afec0fe7cbf8cdc83b9bb2a41ab444eb266a415308dc7d291950aef8a9ed92a38b490b376eac284b86a9fb363242a6d1b6ba0

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\results[4].htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\results[4].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\79ZXHV21\results[2].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\search[4].htm

MD5 2952e41dd090e779c077298ed92c876a
SHA1 383f38eccb7ff5e691116fe232e54c84e0e71b24
SHA256 e75ec2421ad5a0c9bdf41db25fa9e557cf19c804878fe055942dfc75a1b7ce89
SHA512 126d161ceff974ecf3cc426988a96719e9f2f9484aa737a4bea0434347b30827f7e9eb079f30db2e59afb92fc9a39659ea532334cc68b6d08f9126fd2031eab5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\search1WRXJZQQ.htm

MD5 e5da6afdffa984ca84169afedf359c80
SHA1 750899a82a6bef91d2b12fea2d01eb619ad79e8d
SHA256 d55a82b782221466bad06a1f65b39acffcdc47c2561cec0a49e934b2bd929e16
SHA512 5d39410588f6fedafd0ccff9e040ed379ebe0df091714404e78a3766e4356a7233c98111487e1694256fa02dc974a26b2623c9100e79ed4231c46d68a9f6ff5a

memory/1056-468-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\default[3].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q7QYTB89\search2UZCWZS6.htm

MD5 8b8b6f342d72475750a00feda47029cf
SHA1 fc6181d1a23c847fa07890b917e680e8739bdf70
SHA256 b49a455fe381aa645981c7d236f94d9dd174cc2f3216c23d75dcbaf08b4d8d14
SHA512 0bd843df9d565b676801fdbff42addeecda5196230994d2f29f706326abf7236fddecb80c551abb01d70cec8f0c0a72082c168502d4a22be5d6c9050b9b3ba7f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\search3EQLVKE7.htm

MD5 6566de1c5b3996b633bfdfdbac814bc5
SHA1 c8539863d6d157729d6662be8620246bb3a82d71
SHA256 e53d4149cc676a08054f1dbd17acac7e4cd8407e450e2470e35679ce99021c03
SHA512 debd914c1fe05666304a6b960561e9ca951ad3003ec9d9b691651e3d2682aa969e52dd43e8b21f0a5413f456e59b4480e786dcc1c63ab7a06af12e4e92a99609

memory/1056-614-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\default[3].htm

MD5 14b82aec966e8e370a28053db081f4e9
SHA1 a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512 ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\search2W8FQO63.htm

MD5 61365ec6b72ce9096343cd666f2e5eaa
SHA1 569a4db9f70169442585ecd6a6e2a7fd4469cdd8
SHA256 b4990d53bfb8dc4d1bb3c556a170fdee2bf51398230d2d04bd77e474a0dd6093
SHA512 8f8384facfc81988c028e586e583406a5684404dd9b2dc0afb0ea1432c400d67432aefe3e67700698fd3e24b87aa47f3e1e9a755e4168272a09937fa9c84c4db

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\search[1].htm

MD5 2d4f62786b8fd3d73269a2e26b414b10
SHA1 bd4cfc73d073dbf59b95963fa1b016b487edfd88
SHA256 870ee3a803fe059e9d450a79b92c69df463ec78cd88bcade35f1260c0c6ad12d
SHA512 e225b0e491aa826fe102c954c216ce51835e46a7c50c38d1eb72d70007ad0ebdcd9457e3ac3fae839bcaf5cc553fb4993f35e5b8d382964d7e759bef2563e021

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\search[8].htm

MD5 d69d722dde609961dfb0360a81294a06
SHA1 b20e5d7bf19b4e7345ea7bf9ba680ea8ca668483
SHA256 96374b2291fbea63d5aaea9d10dbaa32c996dba1277ab354873b97e08df0670e
SHA512 200fdb73f7d19473e77304a45429f22b5f9c04e2c357954c7b45db6bd6bb7bcc1be1aeb6e0cb467cf57aca797be6a8b473fc05c4907399f9df2ceddb0cd87d9b

memory/1056-764-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9HVBWIRO\default[1].htm

MD5 267ddfdbb8d492b25de208d84b290f1c
SHA1 9f57d9f19f25549e1232489a0c101a92e851de2f
SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA512 0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 e77c5f3bf6801e3a991a72cfd8543fb3
SHA1 06e9754ab1db55ed971576ef60c614faedae8a5a
SHA256 af510d483836f7186845f71c166e9cdfec508262e8ce81555d948d386f540f09
SHA512 c4b62365d80c9fe5bef933b08a1e8abbf0ddb0265c198da98bc44fa4f66213b7a34df33595a62cc4b1f0227c5104f8398d5801c2e0ae777c10a92bb8a2f6a8cb