Malware Analysis Report

2024-07-28 07:39

Sample ID 240611-3wgwgawdra
Target 0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe
SHA256 e2c60ff0fa999b9f135a5417d4a423c728aadb567d576610cd251b6c8084f219
Tags
upx persistence microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2c60ff0fa999b9f135a5417d4a423c728aadb567d576610cd251b6c8084f219

Threat Level: Known bad

The file 0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

upx persistence microsoft phishing product:outlook

Detected microsoft outlook phishing page

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-11 23:51

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 23:51

Reported

2024-06-11 23:54

Platform

win7-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe
PID 2912 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe
PID 2912 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe
PID 2912 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.0.2.15:1034 tcp
N/A 172.16.1.182:1034 tcp
N/A 172.16.1.166:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.2.12:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.2.12:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.2.18:1034 tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 www.altavista.com udp
N/A 192.168.2.17:1034 tcp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.altavista.com udp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 www.altavista.com udp
US 8.8.8.8:53 www.google.com udp
N/A 192.168.2.13:1034 tcp

Files

memory/2912-0-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2912-4-0x0000000000230000-0x0000000000238000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2100-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2912-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2100-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-23-0x0000000000230000-0x0000000000238000-memory.dmp

memory/2912-24-0x0000000000230000-0x0000000000238000-memory.dmp

memory/2100-29-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-30-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-35-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-36-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-40-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-41-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2100-43-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-47-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-48-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-52-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-53-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-54-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-55-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2100-60-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 c40e4bf91d28a5bf2aca07d71180e1fc
SHA1 c3df19ee24d245c116d7b9880ddcf21903f94d3e
SHA256 de910e64daa17bb514574ed2d85c9d5d683ced24ae73fff5450d42ddbd884eed
SHA512 bf1bbe74211a1b896101ef080595951cd0fa405fe66f703ba4e07b8b5d34dcb669cbd0592cd50bec8b34854777c8041045939cfb7db0e3fc6c9f5d9a77be688a

memory/2912-72-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-73-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-74-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2100-75-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2100-80-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2912-79-0x0000000000500000-0x0000000000510200-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 23:51

Reported

2024-06-11 23:54

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1032 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe
PID 1032 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe
PID 1032 wrote to memory of 1228 N/A C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\0e3de145aac9cafaff5003732c0c4630_NeikiAnalytics.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.0.2.15:1034 tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
N/A 172.16.1.182:1034 tcp
N/A 172.16.1.166:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
NL 142.250.102.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 8.8.8.8:53 cs.stanford.edu udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 www.google.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 search.yahoo.com udp
US 85.187.148.2:25 gzip.org tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 52.101.42.16:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 186.107.17.2.in-addr.arpa udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 192.168.2.12:1034 tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
NL 142.251.9.26:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 209.202.254.10:443 search.lycos.com tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
N/A 192.168.2.12:1034 tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
FI 142.250.150.26:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 outlook.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
IE 52.101.68.37:25 outlook-com.olc.protection.outlook.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
N/A 192.168.2.18:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.251.9.27:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 65.254.250.102:25 mail.burtleburtle.net tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 outlook.com udp
US 52.96.91.34:25 outlook.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
N/A 192.168.2.17:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 snai1mai1.com udp
US 8.8.8.8:53 snai1mai1.com udp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 smtp.burtleburtle.net udp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
FI 142.250.150.27:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 mx.outlook.com udp
US 8.8.8.8:53 mail.outlook.com udp
US 8.8.8.8:53 smtp.outlook.com udp
US 65.254.250.102:25 smtp.burtleburtle.net tcp
GB 52.97.211.226:25 smtp.outlook.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 yourbusiness.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 park-mx.above.com udp
US 103.224.212.34:25 park-mx.above.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 kinoho.net udp
US 209.202.254.10:80 search.lycos.com tcp
N/A 192.168.2.13:1034 tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
NL 142.251.9.27:25 aspmx2.googlemail.com tcp
GB 142.250.187.196:80 tcp
US 209.202.254.10:443 tcp
US 209.202.254.10:443 tcp

Files

memory/1032-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1228-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1032-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-14-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1228-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1228-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1032-25-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1032-30-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-31-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 2aa12a2899cc5078f7304fa7ee147a85
SHA1 bb93aa9bf232ed5514a688fac20f296ce19c0224
SHA256 7b196ebfd3eb5007723bbf4480974df476cbdceaf75bcaccbbe6e2b24c5fc72c
SHA512 90d30079fbecd68c3025309fa82255e26ae5158bae3f48b175095f05f5acdb2858b44f1325e87c678ae0fe528776627522c7d7c4d52281d4a0d8997f622c9b8a

C:\Users\Admin\AppData\Local\Temp\tmp1A2C.tmp

MD5 d6153de5ae0ee060854ce81d6e44f2c1
SHA1 afd09936a43c97906933397f44a5cb416b49ad38
SHA256 3cd3b1cea47c52733a36c8285639c645e727d8f9a78f1c542e0ba51ae25061ab
SHA512 869936b9901b195b0c14cd39ebeca5797aa18e9d81776c9048388ab515b0f2ebc76b3913f2dc20a4848b7cc3bf2069b5797eb9abb684ab3d1f5652c536ff6e73

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\search[2].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[2].htm

MD5 2f30443166541d63a80f53089af2d92c
SHA1 21c45f429cb5a8004499a4da632939fb016da3bb
SHA256 6cd9fbf11efb949f4921507065eb00d2990348559deb268a931309da318a2a01
SHA512 ed36eabd6bb0a89c5c6c61f80c2d29e15c7360475c7089007c56e9323b0d459bff99a5454b9bc299ae449679bfd428b6b07e9fcab5cabc949bd0e479825b7592

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[2].htm

MD5 52efbd425b03cc8012888bf5de540228
SHA1 dabe825709ecaf7adfc81e421e664c53d2925e40
SHA256 df3ad236c59ca58a66380a319e6d0ca4aa99005cdc56132f83f484c15ba2efe5
SHA512 7cd0bb67869f8ac974a5122afd0627961ef08c2ac9bc92c51402369978d11f70e66390f772d012efb610ba3e5b67fb0e955b67370b2dfb195cb17f4c3fe79b26

memory/1032-163-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-164-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\VUFV9TZD.htm

MD5 d9edfeccc9248b0d622b89793d81d122
SHA1 f2ed56f36076db4aded770030d0ffba4df042a11
SHA256 85b43da80d942ef566966f292df22ce606ef1ff4e4098cac3bf775c1dd7b6b98
SHA512 eafbc59fa2722f30d0cf67b1fb90bbab3b6822adb68eae8e3cc66421ba0accf5fbf8558186805a4c8e12106df206f3de8502930e569723572aa34105ce417f36

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\default[2].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\results[2].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[5].htm

MD5 f03d11e689414fb6215c320abbdb987d
SHA1 a729f1e6a414937d81a7b7ff3be38bb9fa88b096
SHA256 8f23f5dcba365fe89459180e9e98d0743dc593c14077afb5cdc95df7d09ad6d0
SHA512 043927470502211760723f9760515ec18ee5a6ef489c2e93d0ebe3a78c0d80bc0325cdbb675b63e1a8ba434c5ba16dc277b35d0f0e9fe50d7eac3d25d606bae9

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 1af71d2935e60efcc883192a816f464f
SHA1 858dc92f8bd3aa3c397fa661880bd16e01d8d728
SHA256 683799f996a5c6ccb53e4fd08e7aafd53bf468fb6c436f280071fa60754992b5
SHA512 fe21b960555b4048d84d29952bcf387bac3ab9aa96362bc68e4e2cf70bbae77ec109e4eae4f2d318e28122b3e95ee0be8de27644bcb3b113079f37ba8fbd7bcd

memory/1032-270-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-271-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1228-275-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1032-279-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-280-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\default[3].htm

MD5 215c230635335623c6b1bf5b3b84ae0e
SHA1 a98de5bfab1eef2c02b4578e5d7fd3dcc1141481
SHA256 26b9da0ba2f737d0a226ab6d5b934b0e519aeda10f497cd4738752761ccb7af1
SHA512 5ddb80d7d4fd3d87865ea541098034cf216df76dc34bd41fca62f8c9a21218f1cac5d8a5554e2acc04a2b1ceaf839e5847d14c54f052c9eab43fec28936225da

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\PN3PONI8.htm

MD5 2d0a914e9519a49888744df6c9d05244
SHA1 e3b0a434a6027b296247a050dfa9847e68438c00
SHA256 bea0e964bef0bcd0fab1356bbbf6c6f3871a068568517a2ec00807c85754c1c4
SHA512 6f836234973346f305ef8d2ac5fd46b65bfd959f0d6c87248cd44a2377851e3aa32384fda13031fdab2967b8a812b09031d169a5d4d3c20c602f1953cfa54c53

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 aed245d0ecc4e5801e6976e4ef36d92d
SHA1 c4aca984164a7e2952657b8c3337ae13f35cfc6c
SHA256 60f8504b08b51eb1d6fe360a504d9c8f46422f96d80df0d12a12df80a1bbdbd6
SHA512 e76323aa9904e897ca1036be5a1a06bef903087a96d18e0736d97e9fe4ed0f3c77e06b209c98a23cba7025569c1a16c64f3d920a256ab5cc540edae7c0bc5e4c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\results[5].htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search[8].htm

MD5 4c817452a1fd0d019d0d8ac6f6369ff4
SHA1 8abaf6425b603d2304426b26649e8f7f52cfc13f
SHA256 f918c163b80c6aedb20db9fad8cec8502c5892e18c27bf8eb8e7f5ee0e0b0dd2
SHA512 378aa4a97a5a1e6ce41ea15e20d8d44cc758df7fa5a45c7b039c3ae9f4bf436a7989cb39e30abf877b89414fe25886e1398b141216828a47ffb7db8f89456056

memory/1032-368-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-369-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[6].htm

MD5 633e32af0c5855204acba462c03230f6
SHA1 d052203612626ef0075936c7620aa1c1d17f4d26
SHA256 508a512d0d4ec258834a84ffd9b6da7ff64c02c40a2ecadb53a86fefc6700f2b
SHA512 7a850360a2e6f44a7bba383e11386fa43da7fa1abefa2395b549e9fd2e324a8715401f966f4d5e180f7fd8ad4e61ef5476c0929517f1ab2033c9616a3e7fd4e6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[9].htm

MD5 e4f721df4861d19af9b272907e7a1418
SHA1 a0d4a0219d0ffbaf82d690de7f9d5abed0e32c0e
SHA256 e38c3129fd4f684b09bad68677d612926e04dbdbee81a5a5dfee8d02780bc414
SHA512 21b6fac0136008151a3448629abe49e92c498c03046db31729c21367f6ef4d17e6f846077dcbfb8aa22bca73b433ee980080e42cacf5444ef062b65fa7b0072d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\searchOJZPTSO7.htm

MD5 2c6a678a3514cd569d81c0eb2ea592d9
SHA1 472e8d4c4452fef415a28fa20ca6f5f29f6c8454
SHA256 f42f80ce8c22bc0d6296ce4aa11d7963a9eff45c2ba8934bdcd2282a39e612cb
SHA512 17047d4776d0c86a3abed21b7203ded2d64dfb9799d3b2564b7cb03cd2056d89d52bfe15ccb20a5ccfa3784fa74cbcb51693618ae08f0a32d7de8b48e1f8f95f

memory/1032-490-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-491-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\results[3].htm

MD5 706ce4583fb7e174ccf4d3c8320b02d1
SHA1 67efe83c8f25f3a0bd282d469aeda3162c1b19d7
SHA256 82a58c2ca69ad8e52efd5e0533150f12430f560ee56d885237b8e486be743b90
SHA512 920deab7da828f4e54841a8a0c03a165619c008bf2019c7f9ef58eb793a0d01c96dc48f1f2460e0bd0e1b801acff27cfddbd1771db8635d17a0fe411e9f4b6dd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[10].htm

MD5 fdad744d961fd3f662051c396957c057
SHA1 df1b0e59933b6d947d27cc3a9c019acfcd04149a
SHA256 1951b0cb1505d470d1d9b24053270dd450636b263715dabc1117d8b64874ff62
SHA512 dbb9cdf41853ef78b248e5260ed4c02f174f2746647b8495d640026a7ec2611a89ef419a5070dea965cc4b9f908e5e4505e969f34c27266a3207f923137f9215

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[7].htm

MD5 bc0fe04b8d2cb5119404c39589c9c551
SHA1 42d8bfb08dfe9fde173777bb0af7796bbf832a69
SHA256 e453cfcd0bd4d22751dac8e3aefd319f25470d1d25fe8a210de5db53dd62121c
SHA512 aadbe2d7c296728c11316ea83bf86a5c0a1d0b324aaabfe45db28daf4dfe0b55175ae7b81a4f04c3ddae5c7c254d8cb276def5439b80efe9076cd59ba54db304

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\search[3].htm

MD5 27887219fe6a10db095fb444ac8ceff0
SHA1 fd5e5639b4f4808ffc4c11197c88ea64ae980f14
SHA256 4996f511c4e15be1f0df3e5eed9fa951b1e64f8f6d377f06238e426271a14aa9
SHA512 e05317d2f659c16e700b4ed8fa1d30d4df852e0b3c1bcdcf3961069cb72495bdfdcbc5826167de49037ef020eed00ccfb576ac9cfc09a01dbdff675fae174218

memory/1032-633-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-634-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[6].htm

MD5 550365aee353532e68bc8bcc007a09eb
SHA1 0c536bc019b15b1affb554b44bee9cc0a62e8132
SHA256 163d59990576e33660f6cc57dcfa047144552d656c71a74088911709dc5fcccb
SHA512 34a956e92ae36532278558013700cbc7ec5e22c9e471cc52d17c5edfbcdfb841bf10398d0f2e020f4a0406545cf7adc5e8bcbf4b1c901546c6532c3ff4406c90

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchQ223D8BG.htm

MD5 bd412588fecabe467482e647a9b9d6ec
SHA1 291522adc2fae37ac482577b9f8f91eba79a7f62
SHA256 f98881e5cb30fc9cca03b56e57899c991dd6c1bca7032a72a5e6d6d25a9fd8ff
SHA512 9abeccb13277a5bb46a34383ebe45fb2a9fa46566f232fd461fa1e05651e8a0dffb66528cffc0db266ac02a71dd8d6494666b46aa78832a8d28b054d3dd1f871

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\resultsXGK2C9UN.htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

memory/1032-768-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-769-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchB9UPN3YN.htm

MD5 031591ad48f3efbb9820a9621ebe5103
SHA1 14df4b596badd366c44a49a094b040790ed93d84
SHA256 bdc6e7e32a6f714f3e3f4d140f95922361c9f7ebc7d27527930df45f9dcaa1b4
SHA512 458fbdc7773e713a11e1cfd2790d920730a360c615981f0872e678b8d3ce46b1766af492407e36e6a9b17b6bbd3b5bd953d86cec3abba5bc564953eedbaa0df2

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchBQS9OFLK.htm

MD5 fb58c45512193e867848c61a9a76130b
SHA1 39403576b829efc972a358a2ce85da8fd5d4ba92
SHA256 50398b056043c6b37330c0a85f4dafbddf64c26891241a9308029e3137562ed9
SHA512 db391d7b25f8cfee2346326faf3f7239e372681d2c66898921c7e43363995e1317f3eadaa4720f3022dd9b843b5ffd8d0ba629e81f345b8064c35afd2dc62b90

memory/1032-933-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1228-934-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\searchGXMAAB5P.htm

MD5 4c2b86a47de4231d0a2730ff8a46e0f6
SHA1 fd4a03d5a87ea9e507225cc983d09f4f5186e813
SHA256 60fc3592004a713cb41e4d7f611b90791d03693105ac2bad4f1ebfa6e7ab770b
SHA512 b06740bd43823dd0a786b97befce5738da623368b19a7aec6b61df1326d943b115e747a5f3c655d7211f0295bbb1f3b1e15f51a09943cce535483249d1398224

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchDNGNTRRG.htm

MD5 0b18c502d5f65619525a781ae95fbcbe
SHA1 e2e41821a977fe78f5cbf3cc0577ba0ae98f3f26
SHA256 6e7b134fc4a3d54659789ac8ca771aa458a8343a5a266e9d73227e31307646fe
SHA512 47ac8ac3e7417263848e609f422f0c9756cf684d596fded54472fbebb256fc8f6579643e45aaf6005b3d65841fa3067b3459b1a69cd397a0faa3e7f5df85b311

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 e660c3744f557f9962009f9114f64150
SHA1 8f0b6dbf535593f67b71773db148014918d82bc7
SHA256 fb4d48cc40ae2f9850fa4493a8f0e6f9d13e168f931ab8002d9c706ad62511fe
SHA512 a03ebc58bc037bf533511ae73a4cdd9f1a02c69ff16fa0da3c6e35fb4395d6a3e52127984a8edb09d2c554766082d49baa25a53c74874bda2ed710880a48f9be

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\searchNIBJWRT4.htm

MD5 9d789a88e8303d88fb9e57f4737c9c3a
SHA1 7ab26a5dd5f82ddb2cc8b3c02f3475beff3592c0
SHA256 102995665cbc031a080bc1d76245941a4c7359440ca0087b51e1b2e59dbb49e3
SHA512 b81a4252c6674b183ebfaa22350e4d644598b842d744557feb46042e4289cabec17f04ede754e96a88dfc900a8d212b8f4a93451cfc42d15f83c930ac113d2fc