Malware Analysis Report

2024-07-28 10:38

Sample ID 240615-1pqtpazcrl
Target b03bb38de16d195a958f431112378287_JaffaCakes118
SHA256 a54b1d5b536acbfc8ce5a8a8e8f753369e63face18a689da1cca4d95e8b3a4a7
Tags
persistence upx microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a54b1d5b536acbfc8ce5a8a8e8f753369e63face18a689da1cca4d95e8b3a4a7

Threat Level: Known bad

The file b03bb38de16d195a958f431112378287_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx microsoft phishing product:outlook

Detected microsoft outlook phishing page

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-15 21:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-15 21:49

Reported

2024-06-15 21:52

Platform

win7-20240611-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe
PID 1936 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe
PID 1936 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe
PID 1936 wrote to memory of 2300 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
IM 81.88.166.9:1034 tcp
N/A 192.168.192.221:1034 tcp
IN 4.240.75.85:1034 tcp
N/A 10.0.0.21:1034 tcp
IN 14.96.220.125:1034 tcp
IN 4.240.75.97:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.10.5:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.192.43:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 85.187.148.2:25 gzip.org tcp
US 75.2.70.75:25 alumni.caltech.edu tcp
IN 4.240.78.154:1034 tcp

Files

memory/1936-0-0x0000000000500000-0x000000000050D000-memory.dmp

memory/1936-4-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2300-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2300-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1936-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-34-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-35-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-39-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-43-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-48-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 6cc47d147228cb4d6153a9c1b79ca679
SHA1 79c73090a9e74a4893f1126417d3b8f3737b6047
SHA256 2956a4ee7a31ae2acc93db82d48fc41f4d5cc579a246797c1abebd1352cd384c
SHA512 92a5e3c2d773ce22ee4e355c3286df6c48784134d2c66784aaea2c0af92d0355017af72776810c3f9a16b88f0d1b201aa6d58949816585cdd6c3a2a1e16e6875

C:\Users\Admin\AppData\Local\Temp\tmpD339.tmp

MD5 c895a7bb5132c5257cd241b28ab27cfd
SHA1 47d6aaf9b1efc35a52dd3d4e2450614fdb89c286
SHA256 3438021a7053e8ea9103c7d0a2466937295e721bd95c104a192715c477cde2aa
SHA512 3ccef3340fe4ed546fe2c9466559f3530b5ab4653d50c1031c0b47514485dc8a5a1054b0b6bb9acf0da6fb1864fece5c2ad710c1bd2f51e4fcbf4c6a80359f69

memory/2300-71-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-72-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2300-76-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 21:49

Reported

2024-06-15 21:52

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1020 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe
PID 1020 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe
PID 1020 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b03bb38de16d195a958f431112378287_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
IM 81.88.166.9:1034 tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
N/A 192.168.192.221:1034 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
IN 4.240.75.85:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 8.8.8.8:53 mail.mailroute.net udp
NL 142.250.102.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 199.89.1.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 gzip.org udp
US 52.101.41.26:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.altavista.com udp
US 8.8.8.8:53 www.google.com udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 consent.google.com udp
GB 142.250.187.238:443 consent.google.com tcp
GB 142.250.187.238:443 consent.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
BE 2.17.107.153:80 r11.o.lencr.org tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 238.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 153.107.17.2.in-addr.arpa udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:443 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:443 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
N/A 10.0.0.21:1034 tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
FI 142.250.150.26:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 65.254.227.224:25 burtleburtle.net tcp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 171.64.64.64:25 cs.stanford.edu tcp
IN 14.96.220.125:1034 tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
US 8.8.8.8:53 mx.acm.org udp
FI 142.250.150.26:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
IE 52.101.68.28:25 outlook-com.olc.protection.outlook.com tcp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 hachyderm.io udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IN 4.240.75.97:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.251.9.26:25 aspmx2.googlemail.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 8.8.8.8:53 outlook.com udp
US 52.96.228.130:25 outlook.com tcp
US 8.8.8.8:53 smtp.gzip.org udp
US 65.254.250.102:25 mail.burtleburtle.net tcp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
FI 142.250.150.26:25 alt2.aspmx.l.google.com tcp
N/A 192.168.192.43:1034 tcp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 mx.outlook.com udp
US 8.8.8.8:53 mail.outlook.com udp
US 8.8.8.8:53 smtp.outlook.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 smtp.burtleburtle.net udp
GB 40.99.218.98:25 smtp.outlook.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 65.254.250.102:25 smtp.burtleburtle.net tcp
FI 142.250.150.26:25 alt2.aspmx.l.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
IN 4.240.78.154:1034 tcp

Files

memory/1020-0-0x0000000000500000-0x000000000050D000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2180-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2180-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2180-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2180-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2180-22-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 cceb6f4cc093a2425a0a4211b5f703cb
SHA1 cf91fd68c93beac38591f5fe80e1249b4ea15293
SHA256 06527d25d15762ab23d167d661a77224dd1595b41be6529bcdf24795518ebd53
SHA512 0f3024ff23e4f2d80afc497713077a52c87912726ddfca0e5fcab9ec792c4c8a084c2a0af64e11c8d332ab33dcc6902538ec0db9a369815df025f9b88735d26e

C:\Users\Admin\AppData\Local\Temp\tmpF443.tmp

MD5 f4e7416a4eb6b87cbfec8eced143b12e
SHA1 6b96312e00fc88dc3a758b7cbbe2142fa1ed43f2
SHA256 b3c47587320ba6e5de35f93413101d487b261ed1d878b6673776c59567daf06e
SHA512 9ae00446406b3b9d8feb4f6068700cb281467796658b5227c0bdc7ad06ca6378f18601a4fb21c4148048c910da2691a95b5441acccc9760681e0d64222831f01

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\HJWTJIBP.htm

MD5 2d6729794131c7df6c914d92f15db5e3
SHA1 6915a5b2c87e0f53f6b38bbbd8090c74d5915dd4
SHA256 25c08dcdc6a63d8d82ff132e49d8bb434841bf7abdf0b74b6435cb950fd685ca
SHA512 5d10931eb498fb0df2242aebb94053f96f7caf2adb0ac801fe1c566caeabe808cad324a7ce2e1f46e9739ae28aac028491d689476da2975eb246791fd49e61b0

memory/2180-203-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[2].htm

MD5 58cea4f8acfa8fca16c42e290ac03f28
SHA1 7aeacf051dd5f1cf2d871dc4e641979356b6dc6c
SHA256 8cbe44814622d0264bc87ca1f42420d86f40032ec95167cd6f70b4c4c23aa83e
SHA512 42097faa2d401faea995df201d952bad711f560c626fa82fa91a31f31e012886e95b3a29ab69798c9e72f778ad83b40d362d2623e8111c4dd92fa6ffd800e5a4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[2].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\results[3].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

memory/2180-427-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2180-428-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2180-432-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 77dd71b4778c644f857fa33291b2825d
SHA1 8eb4b3f401d6866bfe76a9edbe4e5fbce50dbcf6
SHA256 82e74c6e4d75dcf4dfcfa8f668b6500a53a6f31b817198719c0ce2fe2f37d40d
SHA512 1d85bf61c1bf9a528380ff8c3c749381c62f3edf37a3b5b93652322f7aeb7aaeebbbf3c15c969a09a577546e1bb69c14f92577031d9b22c8f3af0b87db551140

memory/2180-460-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[5].htm

MD5 dfb86ec3d39793a1ad3c58a2b1ccf047
SHA1 03022718c8bdda71d15e30e20e43c0526575c678
SHA256 f5402ac6a0a5a8fcee3369257ed87536fe9d9f09b3b744f2391a253af9160b7f
SHA512 c111a97aa2a18eeb9bb96d6ff6ded060155b22153d713d86c0bcb492990b1431796a7da31626fa5eba5e260149eba64ba848355e53e5a81798044cb4116714cc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[5].htm

MD5 067f3e7ae1ffbf8a390c11599565cfe4
SHA1 6f45a846e2aa3fca4e6e7f1921a990045ccdb963
SHA256 1b7fff2a2f532f5d52e94393fa61148c64e0d83a208b9d52c2e2cd77179a4f55
SHA512 65a61b427512e3742bdcb87e0624e1bb2b6aa98c64582bf1b6c02ea433a4f196be8fe12de2868610e71fdbb70290e56e1ab0cba753ced08184e88ff7a3282499

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[7].htm

MD5 29792052f8f465fb7978223cae48eeea
SHA1 510f2056d7a34ad95432ca15764287fc6b5b93f3
SHA256 944c07ae4493960c39a5337e3fb1daa1c190724eeea7b3a9adf8aa0e0a85b61f
SHA512 ddc1af946bcae0ef2b1b43ea35df83e079513f4263463013263eb086a88dfb75f5462bdf0d23c83606cd790715b961aedc67dd010250e3d502b8275605861b22

memory/2180-601-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[4].htm

MD5 eed6b674acb4277495c9266fc2bd515c
SHA1 5c3681baaa37c8fac19fa52d33b2ce02e03eaa2c
SHA256 ee0a7e8ecac0c4be439c026e40ccf9b1d8fed6c4a437d497757712c1a1319f85
SHA512 e29053ea41b8f939c36be19415cdcb928de83823f2b478a157f3448512eec9d09670288ad43925fd6729b5dde786a5fef133c11bd037942531892e31f45970be

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[10].htm

MD5 b498faf5d35ae5ba10f0c344de727f3d
SHA1 14995bccf1582e8c2f083e49ab7ccffa8130dade
SHA256 cc109a0b55708d4331f4e7217b15263507a38c1ca99b931c674f72086e35c053
SHA512 2417f9084b5b13a1026c5722baac4beedd6dafb269ff4fd7bdc92306608fd43780d91a31ced3033cc458e4683ddafdda1bfce7892307d5ae98734d833cde01ce

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 70a0cd6bf7a5cbbc3ce77688e8620059
SHA1 115343572ffcea3a76eb8ecc17f035f2240cc60e
SHA256 42c7bb879357b25cc302231b5749df8b626e48c4d3cfe4a04e60404ffd6c4cf9
SHA512 d38c47ad084997ffb73fd81f7005f0feefe1dd920e31e5970a9477f9f3c0ab92ef908068b93af97d41a67cb0576848480df1ba4ab5a8009647d6bef30cf51d67

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\search[10].htm

MD5 8e6d1ef279edd1ab9d24b6e842e06044
SHA1 a4f0bd2c85b7a10c013b71ce432a09b7e8ae957a
SHA256 e9663ea0d11b5bc220f77a95300bbb0062c51bf16581afc92fb4d0c6ac3dbff7
SHA512 6598a4b46338dd9e4408ef175df950de6c5657129c33ae8029c6806569bd87ccea056d58d99e7eba7edeaff14d47067029d835316a547a11acf93fab10915eea

memory/2180-705-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 5f43ed808e351da529977865edaea04e
SHA1 a334ea5ad67e576db6a149f23b5d3257c1ffacac
SHA256 c6705ac6b107b385dce124ee991a3b9988a50cb7dabcdd0455c3248770d53ff6
SHA512 cae58b90be2ed7663fc8960a9d11a90bef42351f068fbb1fa8803655c0eda8e82e39a1e42524881361f97caf4fabd78a950f45b459693689f1ec127039b982a7

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search4NCTY7ZA.htm

MD5 ff94ef084ab95a874797bfab3ef3137e
SHA1 0ae0dadad0029625fed5fe63c2c66e343ec2e3e7
SHA256 00338b59d80a2b787978248f9cb8b49d6c4e962331f3163c1febdaa4f3c79530
SHA512 464539f7337e78420df47bc880e5a708a12ab8123b69dd56af234463411b17769471f87d338fda6456e403cbb9502eb920d567c5683b0e234f879387314ca27f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\results[7].htm

MD5 7a332319b4c67a0c2b49c9fb95a8b533
SHA1 a73a00ba83953575917a2060c009253fc0db93c4
SHA256 3c0cf785ae4898fab36c8e6e6d1ff44a1b980db0216539cc895157efe273da2d
SHA512 e057941f8e9e7f686dda89bd88a6781bdfa6d7f4545c3ad185ebf0a9828b29789f91a616f5eabe0c7c1cdfd9dfa46f443564e9cfc36de6b04f03dfd6ab67f100

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\searchY82FNDEV.htm

MD5 813fd01dc3377a49aeb3b657acfbe39b
SHA1 ee8e425bf134d5dd569a7ec496b37e3cbc63ea8b
SHA256 49903b398b4fabb5e172aab786ada0a42a5e0a3e31a6b98bf7542f69351df321
SHA512 024fe80b8a9838309964df6ffbdb17f0f2509b8030bb49b458ee89e53a90ec72737e00c69d454da0388e3ef5dd9a4de6f487ddb7f0c3c960dd432de11c773594

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\searchHZ6ASEA1.htm

MD5 e54b1eed3eb3a5a328c3062759be08ce
SHA1 35270b2cd92e38671818d2250529d3981613113b
SHA256 be9ce2214add380b2be499289ac2f2b87c09f30449786e46d058e637cf97f8a5
SHA512 ffc98847ef7dd9edde6c84feec5fbe8f29ae45b9d275ba33ca6b20d3821c8a64b16628761cf53e8858567df1cccd0339d444bb86e3fb4be166788d9130a7128f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\searchA324EZMT.htm

MD5 5c35d8aeb848ac0402954fd3aa8e5f5d
SHA1 d8598b4ad199aadc1b4126034a4bf982f53d3810
SHA256 b62634d92b892175e1267c878a1818a15ae1e097c244048f97c25ac0d26e1734
SHA512 bec9db84d1a05bcf534c0cdc26690917900d54ababbd5bbee8f44bbb38a3480debdf5eab4050ce08311f9d9558ed32cee27a13ac672617eb928ff33c417df665

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[3].htm

MD5 084caa9a509cad2039037228bddee208
SHA1 73a6b980e26c8d2b546c289ed9978e24ca89fbe2
SHA256 f096e00f34af3a44d4733944f648c3f3d2376a36a6a9ba96d2fe4c797fcdd54f
SHA512 d122f64220fdc3b142b4244f551d49ddb899b21d5744001095b04b1a49f476bd9bd202a232fc3d004babf6b205cd6df75cbb1a97d19f03b2edded1cc26e6dacb

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\searchI4QZWSUC.htm

MD5 3d6961ebb7f81fdb69cd66c4aa564e6e
SHA1 2c11756cc2e67fbc0e7e62d0d66ce5fc04fe9861
SHA256 13eeceae855d607ecfc664c093d1d58545c35a59f2f5dc5f9b31c47138ae0ea3
SHA512 e514a9a6c0bd495604b058c8a4e91b9fccfaccd2928720cb9d691314f834e88d95dabf545e4efd3877913c450baf614b8986c4df2873fcfa9d84ecae9d40b855

memory/2180-900-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 160d2ccb40fc7fe64d743f654c76c2bc
SHA1 0d256d932a09e50c912f4b5703aecc87e0e2c406
SHA256 234f6908ee824c573955b31c844f5677a0a92393bd338408e9a492c7c43ec2ba
SHA512 3f4c8116daed4268c6d5d4c4218c69ecc5dfc73c7aad8ad2b56a07867374b4d2b6d3a2a26af34169338c1dd49a265b9a4c26ee65cf0589a36c4fa036c0736826

memory/2180-910-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[9].htm

MD5 77fa13cfd5797eeb4b3584065d49639a
SHA1 153c12cc1d97acdfc6aba031fc534539cf4d8647
SHA256 a52b0cca47014f9848bb89880c8e7f49a11b728cf61118f19b0c6ee207bfe8f5
SHA512 76b5dcb440cb9b8a974b197ab0a1b24d6b24671807acf2ebdcfd39cb6fc7aabf218477d5bc78079f06f8c055319bd6ce654ea94b23bf63ad8c5f95caec4cef9c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\default[4].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\searchDW70HF1B.htm

MD5 ecb1d5243842dd5c2cc5f4aeb2e8a457
SHA1 4e18297c2ba931b712710278485e208beaffab5f
SHA256 03dc31b5498b4a3f7bc6281702c1fbc981cea51bddac1049a3f034ece99855dd
SHA512 b9eadf304509dc2e219cb2a33d9b610d454e2911ceca9aa4f63892107fb8387c638b88a00b5120386ea33ce39c5539a2737f3e45397b1fc252913a4e02a6a2bc

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\default[2].htm

MD5 2a8026547dafd0504845f41881ed3ab4
SHA1 bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA512 1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\searchGXQGYF4F.htm

MD5 8bb1a323e0b1811f02615c471a7f7d05
SHA1 cc367f3564e5bfb24caede2e0a2d2a4592bbb469
SHA256 0138cf0fcc26ee42de8d9c65b115a3b8a46df663e709a8f7678f03be12ce6748
SHA512 5872caa98bedd202be09813cbaa7ddc71ef7b7de91092deb6b8b77585509150566f6181986359d56bc2f37c68de8756213bcf9b916d6f2786feeacefe9e730d5

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\searchSZ8CGB62.htm

MD5 039b3c5375d015b668d12b924557746b
SHA1 db40bd5b6c3f3cf1795a7d46aee63ff9bbdd0849
SHA256 23d8318593613d5ea1a5b447cee9273521979ca089d60116ff05c1b5ac9a571e
SHA512 61fe67fcce265863bdf329786739b56d9cc16bf2fbf50af1c25e997bfeb713d279980e7f72cea4ba2419f145b2f118e90d358f8e2aa647bdb1dae64c8f4d4731

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search27VXPCEK.htm

MD5 28aeb31b63fd208913c0cbae9cff79b4
SHA1 e72f3f4c43e61f31ad560d58cffc48e65c6193a8
SHA256 e572757648d2745e7b9c4f38d452481ae84df9503fcd92ce67f5276f52647e1f
SHA512 72fdabb795a8b6c2aa3e2b2e88c1b580d8d5e8a25b48ba0af2746cc4198d60a92188a0c630dae7da5027980f30331a0fe7cf116c56f2f5e30acfa64026c59e3f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search4Z1TA3NV.htm

MD5 9d7cac0953b1f3d755220da48e270910
SHA1 9cfab523873a412db9c9330495f49964a0264dd9
SHA256 9b6e862fe0469aa48994a7ba45040dd4e49b0136e0b64ed140941ebc5d8b1340
SHA512 6735b9dd89c503bd7fb4cb88ebfe05dd0ef3c5b9aa742511179c6b4c4478da23268e0590f1dc9729c7151d44a76d7c87bffa2620515b910ce77e991b95eaae06

memory/2180-1066-0x0000000000400000-0x0000000000408000-memory.dmp