Malware Analysis Report

2024-07-28 06:46

Sample ID 240613-3cvm8avenc
Target 5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91
SHA256 5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91
Tags
upx persistence microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91

Threat Level: Known bad

The file 5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91 was found to be: Known bad.

Malicious Activity Summary

upx persistence microsoft phishing product:outlook

Detected microsoft outlook phishing page

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 23:22

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 23:22

Reported

2024-06-13 23:25

Platform

win7-20240419-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2976 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe
PID 2976 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe
PID 2976 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe
PID 2976 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe

"C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.0.2.15:1034 tcp
N/A 192.168.2.12:1034 tcp
N/A 192.168.2.106:1034 tcp
N/A 172.16.1.108:1034 tcp
N/A 192.168.2.16:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.2.14:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 172.16.1.4:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 gzip.org udp
N/A 192.168.2.105:1034 tcp

Files

memory/2976-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2976-9-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-11-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-4-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2976-17-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-18-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-23-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-29-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-36-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-41-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-43-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-47-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-48-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-52-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-53-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-54-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-55-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-59-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-60-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-64-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-65-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2116-67-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2976-71-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2116-72-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 23:22

Reported

2024-06-13 23:25

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3452 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe
PID 3452 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe
PID 3452 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe

"C:\Users\Admin\AppData\Local\Temp\5dfedcc980a87e69f4a9ea39dd12304edcbdf779df1d668823f009328c4e2c91.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 96.16.110.114:80 tcp
N/A 10.0.2.15:1034 tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
N/A 192.168.2.12:1034 tcp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
N/A 192.168.2.106:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 mail.mailroute.net udp
NL 142.250.27.26:25 aspmx.l.google.com tcp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 65.254.254.51:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.8.42:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 172.16.1.108:1034 tcp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
BE 23.14.90.106:80 r11.o.lencr.org tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 32.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 106.90.14.23.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 104.17.79.30:25 acm.org tcp
NL 142.251.9.26:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 65.254.227.224:25 burtleburtle.net tcp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.16:1034 tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
US 8.8.8.8:53 mx.acm.org udp
FI 142.250.150.27:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 52.101.41.25:25 outlook-com.olc.protection.outlook.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 65.254.254.51:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
N/A 192.168.2.14:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 hachyderm.io udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
NL 142.250.27.26:25 aspmx.l.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
NL 142.250.27.26:25 aspmx.l.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.251.9.27:25 aspmx2.googlemail.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 52.96.172.98:25 outlook.com tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 65.254.250.102:25 mail.burtleburtle.net tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
N/A 172.16.1.4:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
FI 142.250.150.27:25 aspmx3.googlemail.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 8.8.8.8:53 mx.outlook.com udp
US 8.8.8.8:53 mail.outlook.com udp
US 8.8.8.8:53 smtp.outlook.com udp
GB 40.99.202.98:25 smtp.outlook.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 tcp
US 209.202.254.10:443 tcp
US 209.202.254.10:80 tcp
US 8.8.8.8:53 udp
US 209.202.254.10:443 tcp

Files

memory/3452-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/5048-5-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3452-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/5048-14-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5048-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5048-24-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5048-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3452-30-0x0000000000500000-0x0000000000510200-memory.dmp

memory/5048-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3452-32-0x0000000000500000-0x0000000000510200-memory.dmp

memory/5048-36-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 675778d1b7603c2c4642a19c7d9eda1d
SHA1 b8eb4cc19b1cbebfba9f46500f66760f93443885
SHA256 80b7a18a6b7ead5f44e34358f74df789f791b819da72e5a26196fedbdbf0776a
SHA512 567380412d66540b1d37b18bdd85492fafa07e3e0292e8b2dd4f6fce82673c143ba668c6fd4a8c734530f6801827c551edf4bc7662f75c4c8f9a8165733ff19f

C:\Users\Admin\AppData\Local\Temp\tmp826.tmp

MD5 adf4f52a508bacfc8040deb779f9d1b9
SHA1 2b3e2750c8ddccc9020d90ac9831222367bfd6c2
SHA256 343e1b36c2ef59c22ddd281bbb7c061b14aac317f51e7812cd3d0d961e07ca0d
SHA512 298d81306d5582d605e11441edbddac1de94dbdb2c2093998fba35278a98409bb6f5da3b03a9ca990276704de37535b2bee446ff2dd898c9a8faffe216329e3e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\C9GLASE6.htm

MD5 e40d3824ffbc61f70bfd6313b8ca7735
SHA1 b85d09d54d8ec0b13478101059e1ab820d8d16d2
SHA256 418d675bde1ed4ea690f143cf42a1f2598c87260648a49194483138a47499f5d
SHA512 6407f8770e1c5f292f70d83b05a8a785904ae79d9dc3022ec50da5d86348e828b8ea53ceb849422f0e688e8bf60121ac54f8c7dce4962774bafb1d891d11a90f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[4].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[1].htm

MD5 643c5fe71bfe5a24ad9319bf019506d1
SHA1 0f6ec324766f75af83c783df173af1b5d171b89d
SHA256 d1dab6f475db3a4037a3b159c0b4c35d581038def61434940df2f897b144b54e
SHA512 497edeb2e104d8f5defe8415a1842f7341b66774c88359978220ad7ce4e7df194ff1da3711b262523443e9d653e603d89dac456d5b7b70bf2b069f06b678e555

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\W2UFWAOO.htm

MD5 222903ea3d909e83506c693149657059
SHA1 7161067e2bc8f632f8df14f461d8b6ae06cab8d7
SHA256 680b513f40bb9123087080041c42b5b7e386e024872d5015756ff69aff07b7e9
SHA512 f27f8f91b6d1bfdbb0254adcca9a1586803796d2eb6738fc8c5c23bcc88513e6f197713317ba7a25a77a41fc8a281faf153720ec9a978234dc483b42e60f0e3a

memory/3452-173-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[5].htm

MD5 c34f4bd1fccc74a48234689890ba2837
SHA1 9416c84f28d9c6b23c5f12f0124ae89398421eee
SHA256 f1243a64eaa4f222863bf304249ac44e14929a24d6025286085cd8ffee4c0e94
SHA512 1e649822260ec4a91b449926aa1aed6b55ff8dd11752e0ddc21293ddaa17ecc2b50970fcb1eb323d24ffa33ca37b799833d813e67ce435aa5ef1a46c1ab0df0c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[6].htm

MD5 235881be8cf22bcc3925e578e042085d
SHA1 b6bd0e40bcd2747c1a8a1e8683c3e5b07f95e69e
SHA256 c92937ecb93dd2dae195196321d99a6d524cd236cb95ca0b8a5f386cf0e3b29b
SHA512 9164e75e6edb5a1ef0e45875a9e6cb9b1167678e1a7a767adedd1a53aacd894ff87be49c078f10d234947b21a0bb8e252af6350deb63a7389479f3763b20051e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[5].htm

MD5 817c24db982a72a5cd1ceee8e33b8141
SHA1 be658a2dadd6279bc039f49e1fcce4ad5b589905
SHA256 172f2ea39a2e1ef1b8ab8e1ddb032aebfbc8979304f8266feded721064b328ff
SHA512 4b2a71ae781f5007b7f29c9f06c912283627ff310bde2720779431ed294844583ea9bcf6dacce08059ce843cfce6fb8549cef96a1425def8d6afc1948a204125

memory/5048-233-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\results[4].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 fb1cb9ba9ac0366ec2c4e3e00a4430f2
SHA1 6a47a58fc2e13c2b1bb9e413ecf8c64b3ecf71b2
SHA256 a0e43f5373a4ef7994cf69aee80c15b58df6bc91e8be374d0d67ab507ae61ca9
SHA512 3c0292aa802a4e3e62d75de07e13b61f6594f5d1225c1a21214be84a46596dddfab5b0cbd3df334862bd114917d01e6b8d3e39b2efd77877de5f8f98e1c870a4

memory/3452-326-0x0000000000500000-0x0000000000510200-memory.dmp

memory/5048-327-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3452-328-0x0000000000500000-0x0000000000510200-memory.dmp

memory/5048-329-0x0000000000400000-0x0000000000408000-memory.dmp

memory/5048-333-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 285617480acf178e87b29b780c0134be
SHA1 8d471bbbf6e671d1346194961d4f4bddc342ea50
SHA256 44897dc6d77c409cbd1c4a508c82db8ad4199fca5ba8477544385858a91c2232
SHA512 53365f172a216e051a10f96b8854d5c4ca3ff02cc206f974811ebcace0e7d4ecf91776ea65381cdd0b860a93373cf07f2b8acac5a486df0da207a087cb15cb5f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search52TP3SNK.htm

MD5 efc1841e8fd2e1da46f9ed2d5b839481
SHA1 cb3d07363abf63f02e3e4b42b4f1420831e0d603
SHA256 f8ca846f59ebf291ed13d4731cd3dcc30ca8924b3491245f195f846f918c0f46
SHA512 01867538eb95deadbaebc24890142d0b0ea9d29ed0f8156e0b8f2a94e1c21dfe89136938664eb132855b609bc6717922c3f31e25fea63babae1288a49f90f626

memory/3452-380-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\results[3].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 8cd4be87c406e396d94e33344b0cb3a7
SHA1 facdc27a8a95f25cfb1fbd4b447d8d143d68166a
SHA256 e34eaaa68b28d1c608bdb65638847439a9b36b8cc815c4f228f9b3ec9567b6fe
SHA512 bdd711123c6adba830897f3557f8c46f788a568919b0f6b63d4dae08954f2fd579b5c1e45ecce7162aeb20726cca48bbe86da9a8b2cb8081f0905ee18d7d4000

memory/5048-432-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\searchZRM3BEYE.htm

MD5 6e03720b1880a98c63e4da246c9d9b5c
SHA1 379e3fb54914f6d7a2a8cf4dcd707cd851843571
SHA256 333ad7a34222ea02105fb415bc9e39f6e7956e18b06174986731557e78e6d432
SHA512 6664f448722447dfc970f5b7d8428968a6cba950daca29455f45cc66464ec579f9e080d1475eab70aa48c8f81c0a2fc3c51778dc74880cc61b3536029894c802

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchTG5332CO.htm

MD5 1c03f8252cd2cb6f5c467647270a8f22
SHA1 865b59fee380c912edef70cc080fcfc71cf86429
SHA256 0b5f90aeb825d78031899155574b4f91c67da96966699e612c5562e93d3642da
SHA512 e8268adb8d574de37cd98c571d6ef92348daaf49e2e441889e413d01308c591ba03a664184f1471e096e57e355f77dd14cf71c5baf25e746d36490fd949dd7ac

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\default[4].htm

MD5 267ddfdbb8d492b25de208d84b290f1c
SHA1 9f57d9f19f25549e1232489a0c101a92e851de2f
SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA512 0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\searchWA4TTYAD.htm

MD5 0128863d46086023012aedb60c12c0b4
SHA1 9a70fa82c39843fd6d6790c50a31e6eaa2ae57c9
SHA256 f34b4523acdb2719dfa7293fde5eac0b79061808ca1cad2c5245a44e8476a858
SHA512 332f25f44d5672f376163cf496d969f8802fa7cea1d0984a09c048c1d7605151f17f1109f97faa2066de042562a958849bce5b15161a0ed931c1e16f320f528d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[10].htm

MD5 dec286a9baf61819bdd0f6341b2a0d13
SHA1 bb05a330bd7d6c57faa07634c140a564e9ae11e5
SHA256 bf65de57892cfea4179076ceb2d437b77107b0362e04d5f74956689a003dfcbf
SHA512 268eba98d662dab7c8837cc9df0f69216266bf13dc25b40fc93e211a419edd51cc1dec221f0908457d38352673213333ff5ef49c4781574882edbd58407b46e3

memory/3452-563-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\searchN0PNI1L1.htm

MD5 2cdd3af081ffb89319c145d2d68b99bd
SHA1 1d4df9fd1d700ba082b6340fc9455587802f5a49
SHA256 b149e8bade5abffb32692c661036431de3465ee3d65bd61f4bfd759f9ef144d0
SHA512 64a82437a9b7ca72c4728ef04bbb055acbcecb10a353818a829ab0f283b76a42f894915123ac89a6b1334620b129fafd9e804a4c30d9c5dfa0c8a41a36783c44

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search3R54S2CH.htm

MD5 91e817d7614ebe6fdbf941754e385629
SHA1 8e99b3a3a9b070c164ec9cd261e5e593e0f1aa2f
SHA256 718e062a9075b188159a51b7393593dbb4c4d37d1b5a925f498fe08f63e1d4d9
SHA512 1573ae6eb66515854a93f1351b71d3ee12a47686e645ca6fbcb4f22118e7b9e1886ec3fca31ce9677d8d016cfd139751548b5ff9ea155c4c86eb7f24f696d4f8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\results[7].htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchNSYFMD72.htm

MD5 6d3bf441870ac3e4f1c1f173d599fda5
SHA1 070b9b8a5a35b42d0aea38e3b0e4840282cb6856
SHA256 b1362080529ffe1cf25e406b6755b561a71030c6cd7f2fedb70bdd3bb45f703d
SHA512 6fd17ff6cb19a67fc7b61ab9b163a7ad7910d9d9346b336707b18c447cca6bbd3bd9b56a3f64ca7cb0d5b48cfbe189f42ffdae4c63594cc60adfdf224c8d3567

memory/5048-645-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\searchWY1JTTCL.htm

MD5 cca8561f52b00d7d59cdb86d3801171d
SHA1 be2c434952f086b7e9e0724c821314028dab8d9c
SHA256 83833327ffe3726a009de4f9cbe238d4aa4c9bd0a29d9c7006e25b257af5f499
SHA512 8d311e7582b33d6802db7209af235b2bf13efdeef84b58bb3421df29b5d863ff0dd9614538fa86e12239c66d5f95a49fe9ea565b7d10220bfdb2b463cbd4ed5a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\searchYVCLTDNV.htm

MD5 73abac908247362945b5cfb697d8f5e5
SHA1 f5988ec318dace113690119a3e4c59793de14ced
SHA256 dd910dd86b78b3fd1e2868990329c070c2083e6ce45bf470d39e2fc13b78128e
SHA512 79a2654fb8a4fc5e517cd0ae689afb438d7103e66c117deac1aabf35061a7f4661fd66c7312788855d04e8ac542afe1e09b7156ef80b6b8b3124bdeb9474e557

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search6PL6TELT.htm

MD5 5e96aaa2902a3aabe65d52df705969f8
SHA1 29e8ed64b1b8934a4d6dde1c3b381af718b4e107
SHA256 6fc18f7cae3f47b2c9b98f349b63723d58917dfeae3c6d92aad83c65f5590d7b
SHA512 97731c5a1c60b871d0c3ca2a2cfdb153e998a80024c71dac9278793771e55681df9a419834d670fb4582985a30eb8e3067729c97b0ad948b0550f074e8e394e7

memory/3452-756-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search4N4BBGK5.htm

MD5 7cbc7e4abee47b60679143bfe6a2ccfe
SHA1 ec841b3e7855266ec087286eb9705110e8a85508
SHA256 7d8654eef3093287146550195cf7deeea4405d80952b291b695ad290ad5be071
SHA512 10d7829766d487fb78b48e5941d254b288d9e76424a5e8e880935bbeb46d4c9efc89cc03ab527dfc85aa5dd6cf21c75d3a92ed3032359fb59cf8e0a7af1e6020

memory/5048-800-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\searchHTCC2YAO.htm

MD5 9eae1c95a603a782a876fa616d471d6a
SHA1 752a47280356b8ad2fe21369f3ebc7045a78d87c
SHA256 9a25c36fe4591d9d0b870a75462a813446e02e7d6dc2d47613045fc332ce1cef
SHA512 4bec196f1d7e89358fb9bd8866744a4f34aa336698dac0b8ce8ff70415e036877a7bd7d295a1f1a674837e5287a1a18e9516f27a5221d2a5e760306a86824342

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\default[7].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\default[1].htm

MD5 e5c2364375c0a8a786a9508a840b6299
SHA1 bec1874db0d2348274b6656d1383e262f73e2bc6
SHA256 51b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3
SHA512 ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3

memory/3452-916-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\default[2].htm

MD5 cde2c6ec81201bdd39579745c69d502f
SHA1 e025748a7d4361b2803140ed0f0abda1797f5388
SHA256 a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512 de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

memory/5048-947-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search69IKMW2V.htm

MD5 3febc53a5682051798052740e615550c
SHA1 e6b5b6e95bc359535a28393786298c6bc2ef8bfb
SHA256 e909727abf8b4022b96a4eb2e75c1160acf68adc39a9ef5783627c396a3c781c
SHA512 d1bcb6e63b935df3ec421a82f98e29487d5c3654a94e1ef87f6767cac663a794025a62481dbd531c89ae0f6707caa7c3a461c927f754cf9d223b90e94a78e4e1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search4P2830WN.htm

MD5 ff237a858184026a846748ca7d349238
SHA1 4b41d9ad96695c8cc2cd3b48a55bc6661a3d0223
SHA256 a87a5c1489bb47bd4e4f80d789f70dde92bd07418a6ec4f137e25c494ea27277
SHA512 a3f45331ea89ff01b2302ea79bff6e49c45229cb00768c72cd47a87718688fd1579397fb7984c8c46b8e0bd75d61820f830c681fabac7173f18b8e038be872ce

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchFLC18T2Q.htm

MD5 f62bde151187e0013669d52d63ced117
SHA1 9e7b44ee42b023e1b48257fad5843c3334f00e29
SHA256 cf799b2dda5b8a0318ece185656f82e29deb8cea6516c5ee1a990107461fe180
SHA512 4eeebd78400a266fa14c1051ee7f8dcad6b36491383367feab4e4f20cd0a1f883a94339f44d0d38890ef5495662a7385342f9aa5aca5a2e9c8d2bdad31378684

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[3].htm

MD5 f2b051737ca85bdd688d91464bcf8311
SHA1 632b61676c614ee5ef2f59818b84c683e5298730
SHA256 d556b0af1af50d0e78ec8842543b49d8793b097b999bcc98cab009efaaf97119
SHA512 1b47af863b03ae4b2876c8c62420f6be613f6769ad0eba05d29d78770aef70e4329b50af77800cf58a66e736bba1af3ed1dacc4afc269a5474dadca912afb8aa