Malware Analysis Report

2024-07-28 07:01

Sample ID 240613-1ynqpawbkm
Target 405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b
SHA256 405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b
Tags
upx persistence google microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b

Threat Level: Known bad

The file 405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b was found to be: Known bad.

Malicious Activity Summary

upx persistence google microsoft phishing product:outlook

Detected microsoft outlook phishing page

Detected google phishing page

UPX packed file

Executes dropped EXE

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 22:03

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 22:03

Reported

2024-06-13 22:06

Platform

win7-20240611-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2384 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe
PID 2384 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe
PID 2384 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe
PID 2384 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe

"C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.135.189.123:1034 tcp
N/A 172.16.1.3:1034 tcp
N/A 192.168.2.108:1034 tcp
N/A 192.168.2.12:1034 tcp
N/A 192.168.2.9:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.9.5:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.9:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 10.150.78.55:1034 tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
N/A 10.202.221.84:1034 tcp

Files

memory/2384-2-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2384-4-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1152-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2384-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-23-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-35-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-40-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1152-42-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\widUui.log

MD5 2e9b518df479ecdc81bea47f9cec0006
SHA1 f7b071fe9e27465a19d4a8cb0ab1b789d82d9592
SHA256 d89939426d83697ccaa2e7676d660e7c9bddcd41135c0668ddd24de1069736aa
SHA512 7315919f61047fc953f00fe0c180c9193768ce79cc81a047629cd7bc3b858832e9dbbdaac50044f000bd3716d63b95bbb8c5e22a15eb9ed62c176a6e641baa60

memory/2384-46-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-47-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 78048d10984c70507155c0c818cf5423
SHA1 03222b6224d42a589f496883d3f61744ac6a2ebf
SHA256 395ad9cbb2275f943cbe04b35b84062cbc8fe09bd9fcd5dc0c3f5315931e3126
SHA512 11db2b478470310f8483dab63349d47175a0f4f74ec5cd20579cafc3aee352aef6233271fe6a972a7249fbb92e8071f417911899cab5ac726a3be78edff4a94e

C:\Users\Admin\AppData\Local\Temp\tmp6C3D.tmp

MD5 ff0a6413d1639a6b72bc6994222d4aff
SHA1 26f401dc4f6ff943b9ed0f401859a62b8c23a513
SHA256 8b5b1cad06000dc2e1e0d5564e4f6e0bd8533ac74774f84d213812bc634c406d
SHA512 2fc3c7b7c6ae47341eebdcdcfaac89e58be1ac4d02bfc088cc1495d884022874a33fefc829340edee1471258348481d4d82b9530bd18f6b066592a04f5b1c0e2

memory/2384-67-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-68-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-69-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-70-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-74-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-75-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-79-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-80-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-81-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-82-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2384-86-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1152-87-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 22:03

Reported

2024-06-13 22:06

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe"

Signatures

Detected google phishing page

phishing google

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1188 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe
PID 1188 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe
PID 1188 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe

"C:\Users\Admin\AppData\Local\Temp\405538a24d482c762ac6446959b2ca287ed28dd1d1db8459e50651dcc31c075b.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 88.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
N/A 10.135.189.123:1034 tcp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
N/A 172.16.1.3:1034 tcp
N/A 192.168.2.108:1034 tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 mail.mailroute.net udp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx.l.google.com udp
US 199.89.1.120:25 mail.mailroute.net tcp
NL 142.250.27.26:25 aspmx.l.google.com tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.11.3:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 r11.o.lencr.org udp
NL 23.63.101.170:80 r11.o.lencr.org tcp
US 8.8.8.8:53 32.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 170.101.63.23.in-addr.arpa udp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 98.251.17.2.in-addr.arpa udp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
N/A 192.168.2.12:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.9.5:25 alumni-caltech-edu.mail.protection.outlook.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.9:1034 tcp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 8.8.8.8:53 mx.acm.org udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 mail.acm.org udp
FI 142.250.150.27:25 alt2.aspmx.l.google.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 smtp.acm.org udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 85.187.148.2:25 mail.gzip.org tcp
US 52.101.42.17:25 outlook-com.olc.protection.outlook.com tcp
US 8.8.8.8:53 coloradotech.edu udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 mx1.hc3950-10.iphmx.com udp
US 216.71.149.25:25 mx1.hc3950-10.iphmx.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 192.168.2.9:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
US 171.64.64.64:25 cs.stanford.edu tcp
NL 142.251.9.27:25 aspmx2.googlemail.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 outlook.com udp
US 52.96.172.98:25 outlook.com tcp
US 8.8.8.8:53 mx2.hc3950-10.iphmx.com udp
US 216.71.149.25:25 mx2.hc3950-10.iphmx.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 214.143.182.52.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
N/A 10.150.78.55:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 8.8.8.8:53 aspmx3.googlemail.com udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
FI 142.250.150.27:25 aspmx3.googlemail.com tcp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
GB 142.250.187.196:80 www.google.com tcp
US 216.71.149.25:25 mx2.hc3950-10.iphmx.com tcp
US 216.71.149.25:25 mx2.hc3950-10.iphmx.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.outlook.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mail.outlook.com udp
US 8.8.8.8:53 smtp.outlook.com udp
GB 40.99.151.162:25 smtp.outlook.com tcp
US 8.8.8.8:53 coloradotech.edu udp
CA 45.60.205.133:25 coloradotech.edu tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp

Files

memory/1188-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/1188-5-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 24fa404ed4f96c3a1af123e88a090ea4
SHA1 24dcec7def84c358e2f31ebeb2272e8050ec9695
SHA256 a5996eb297713798c50c5a1757ee3a199e66b8997c17c8fd1a8cea2d22851d1b
SHA512 de81447f4ee95412d43207fcd5d1d7f28fc5af35433343a3021545c6b91ee8971cdb098821ff4e94726a0dfa8ad854569ad9057f6d11f7eee7c98daaa6048b72

memory/1188-14-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4384-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4384-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1188-26-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-27-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1188-31-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-32-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 8f1de2f82b939b09ec460c368462c0cd
SHA1 3ceee6f084fcedb5f100d1c549bd63ea69a32391
SHA256 92bede3a0af6170ba6980bf9771b7f9e3a01e8f77dc1627821f65fef718ba977
SHA512 3baa8ec1906d77fb4cb173fc6ec02bbbcc8ba204f491bc207d0b4db4bc11a08d766277f393994ac7867d3b2faaa2d651145226e8e80a3e885247668458c65321

C:\Users\Admin\AppData\Local\Temp\tmpEBA3.tmp

MD5 5cea09b221e66deeb5a9fedc3b796cfa
SHA1 2e5fd4c3d934c2516e3b98dd9e0fd33913dde84c
SHA256 fac839149a928a36c3be2b7986e2b50a4dc6db529920083913fe5a3b2f2e842a
SHA512 c7dccbdc4115dac90fb797f16a3dc9ac8507e0261da9491bb902368f70d8b445ac76e889eab290cb540612e6692e00284da2a8a595d953e63ef1654c11b8d64d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[1].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search[3].htm

MD5 b67cd11ce55c21b574b3317e0f7ba2d3
SHA1 aefa2a384ba1b4ed80ab3e8524f7301267b92fff
SHA256 165344070db8435dcf12ed32ff6092ca4b5abc50fa4c018e4132ceac086e2135
SHA512 320ee6905ee3b7ad92c499e7ca596a1812bbd326e847c3f103a706b0a55d9999c573d829bceb75f5c280ac1f5e0a970be65f529425316654eefb1460f185eeeb

memory/1188-128-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-129-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\GK2CVUOK.htm

MD5 d6b7c1b496aeb54140daf2ad393355db
SHA1 6312fe5b2ccd8f84720147657d2b4a9ddc5f74b4
SHA256 be101273b43b7a713d086857746b0428af394bd934f44762d35fd4505c2dccf2
SHA512 54347a82655a077b3db9b3033ea68511e7d323b5b148ebeaeb90b01a977cd52ba6e157e21b9dd3fd4039ea44f8d51f9a35ef92659b3bc424a1d1f06b3e65aeb8

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\107ZK2SZ.htm

MD5 a0f238eac41397be03d0b041b476dd19
SHA1 d1e1ee585ead5f070cb065a166e11e51789050d5
SHA256 4de526d8fcf66d70ca6d4e8459e70a05d7492d4f0aa85f8a226a154993054561
SHA512 c9e41da394f664dc85b8777c3daee3e80db17132cebdea4edb9fd0606f6f68f79e3688eeec7296e9185e5b970f2a4763ec81a6fda2d831925c72e8d0e820abf1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[5].htm

MD5 7dc71be3089dc93171dbafc6b3132f91
SHA1 f0202dd4e71f37e90f325b08f8e77b7925c593e4
SHA256 91a30f4922e7a3803a91d1d3d85d0ea8076f3d5f81f9c2b4d9605d65a897ab0d
SHA512 e89f94cfd14e3ced8065e30554d5f98f7b48d95920c99b565771ff2febf79f1bc9fbcd754cd9ba078a67ac13c16987a2c6fb32d65af47de12a0debfb3eb1aec6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[3].htm

MD5 87119d5c9680dbfb8db06d774d00403a
SHA1 6359add192fdb9bc1f73aafede9d2cd641ec3082
SHA256 f3b4fe126434910afc068950e69d11db85b2869912bfc25bf55ceb6d4821f07c
SHA512 e2d2966d8b6c6da9300ba45753297511ce7c9d4e858a1448955e9f81f0773560b50ccc4452b7432080acb86baecda42fde73d6ed4cc99a1fb3bdd1c51952f676

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 b38c29e69377e3d19c904dfcce054022
SHA1 724e3e914dce16d4826c24100fe8c613846bec71
SHA256 f7c926ad180f456d9be91e6502e61cef8a07c978bcf393e2a2b9bb8233f542de
SHA512 e54fb8e9b27c679eed644573c37162e425a9b5f3454cbba190a508a22a0adbc397e57e0c52321b0a5d605767cf653e443da95105c68039a8994b4c706c2310f2

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search8P0DOZY2.htm

MD5 7dc53c1b7c00ac02be61b695aa6e6273
SHA1 d0257aaef4e6e90eff77285ce61aba8469e00826
SHA256 f182457b55dd69cae501b873675746844f9b1538e843356c82c7c15e59cb0681
SHA512 8d48d206ebd559138b2c1b01b520d1a8a78fd7d6e93a08727063b94c13efa7108678cee69e96204ef52d2cdad691f80fc3beed3d484e196a1d5ad281f55fff3b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchLKAIHJ6W.htm

MD5 2514ed476b0562c4a73797c591218832
SHA1 4d449fd91ebd286ad9d3912aecc57cd85a67dc7a
SHA256 8223bc8d89dd3caf31d18b981789282993ad491d65862ecabd9cbd0d2693d825
SHA512 7810c9f9ae8faff15ec2f27c94f3edae9a5cdd6980c4253fc4520033edf5cbff74b7b8361bd9bdf2879cd36f91175171c6b5b4ddc8f55f36819fa2d6de9f2e57

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\searchEPJARMI1.htm

MD5 f1729fcf2f3e06b88ea468e64ad906c3
SHA1 457a8a478495928557bcd8295717e4dda3067035
SHA256 542bff5322b8a6f8e8f7f85ab8175c3b6d12f184557161ae9f17e2ba770f8879
SHA512 bd5894bd967a3a07d0e9ab1e41fbbdc70683f8c7c6b29d22258bfeea96b69ffd803c3b70c06bce273d22839f05fde95aa4bbc8e7ff3d17114e5d88085578e3cd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[8].htm

MD5 d318509e3a373e8db9ecc4e104136559
SHA1 bcc04f0e023f4b5560616931c7de5026db680db9
SHA256 a767bb305d09fbe8c41973c1758dab38ed63ad2e9e48274e79c7e4d3dda654bd
SHA512 c6e39fec7178b9f03ac8073d9b9b60d2a20010b334889805d7c9f622ee45c1ac5e24d8b619b70813a3cc9ccfb282b397ccb40414a2afe8e862ebf104c1a28fcb

memory/1188-285-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-286-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ngnckogk.log

MD5 74e65d440183a83a98eee495c1232bb6
SHA1 ce53d6845720dbae2c2ccd0a2ec8a4639550e0e8
SHA256 c5ab62df09076c7ca52a66138dfe3e4728d3ec896806d25647ffd2fc955058fc
SHA512 f4ce798c2f6f9b0437c146bd3e3e6be79e397fa86ad1bb1a63db8d5352f6431cedce7f673aab1d0453519f46129fd6b73a3264d1a5de03d76e190cfdcf7bd4f3

memory/1188-289-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-290-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4384-292-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 a48ff8948e5af63334710f68848584cc
SHA1 d8ebb55ca50e5eff4a4225418977943cc8649397
SHA256 4cfdac6c5cbcb8cdf632d5694292f24f792f95cfdf540050ba15fc3c912ee6b7
SHA512 61a634e4ed9b8d4145d867f23a75c7550ba2db37089809462e806905d5aa31a14160f37d2fb4b91e7f6a21460150d6a491fc4ebeb5ed1f8cb06d1d1098d5dcfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\results[3].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\search[8].htm

MD5 c93db70b948f3f736a158d632fd33a1e
SHA1 9ed213b6fe15d737b51163fedd80f59e40c580a6
SHA256 9bbcd3bcd81a0caeb9caa3686f929d6cb9cfbc6f0723b3fe3e06843a55210d1c
SHA512 a56b30e9972b2468fb459b4499c53d2d1e733d8a13d4f2c96ae49676232817203d3be07b3c29ff84df5b0f65fb4077c6ed5be8b3b29875cb34974930f0e81cea

memory/1188-390-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-392-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search6M7O86U3.htm

MD5 26991fdda10d2c55ce82dec558a76eca
SHA1 24ab46450b195509be8fdeb758afe9c8b4146eff
SHA256 59c5fe8ac6c6cd5adc8101570fb16fecdd8c16894cd5af7cfa087fd25fe18b2c
SHA512 ddf233c1d39c1b75cad3d6354aaeaa1f2b32b7e0e73043956e34f367de37443d891fcf18a75c424b34bea49f69ecf68d6ddca36eef7433e14268d19842e0901e

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search[9].htm

MD5 043c2c4f6cfb7db6d82f125f99161943
SHA1 1e58c5c97a3872503a43c7ba6827a4c2f0c4abac
SHA256 e355f33a1ecb45a35bd9d05d9f61d3aa64f9b4e13d3462cda535601f30875c01
SHA512 4f378087118f8cc46acdb25eceabab1bd9f4d2204d84123d9897e7cac1e043aa739cf0a92f07ff5c6560abefc0315065feebd175590ced5a3cb0c6493a052e47

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchUJ2RWBHE.htm

MD5 246ef77a8128b400dd6ff9e9fdb96437
SHA1 478e6a298970bc6b415b8dc12026c58d6f642c9a
SHA256 75d680e46615513cc48f49ccf59a3c4e5dee2f9ac203107d2b7bc0d4992aaca8
SHA512 785885b228ce2b43fc4b06730a093105dbbbd1f52ff033148b69b1889f6206414b9371de4a8fd1ec3d766e58975f96278e537ad0b2124bec3db676cc1ab3c5c4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\searchNE9EFXM6.htm

MD5 6417c577b7ceafac6c0e94a22ba5a75a
SHA1 5156ffa52bcdea67c9476d1c1dd1d44ece576bc8
SHA256 280ccfe812be08ff3585da3fd8b5fb0cca2f76a03f4ecf45551f47f97039c3d8
SHA512 65707a5f335b743355fd00cf62a20e88b2676c112c383a1d74611106dfdaaa5435d3517d5f909ad21f699ee7d183ceca804ca5327414cbb286f18528853c42f1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\searchQMBHN34U.htm

MD5 37294c0d0ba0feb82aa5cdab12378bf0
SHA1 f4aec02ecea32e3a936a46f565cf68ed33932598
SHA256 358f99975b2b0c2f594b4c0db63c29fc88b186bff551f8354ffe4868f2697132
SHA512 8c83037c9d6dce9665942587041d6e07a2d22ac5e243963957bcf792e971cd2dfafdace38fd3cd2d7c9951db804149c0d3dabbe6f093e4503e19d4865822b3eb

memory/4384-555-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1188-554-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\default[6].htm

MD5 14b82aec966e8e370a28053db081f4e9
SHA1 a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512 ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchIEAZ7KWE.htm

MD5 9796b036637e3ab88797c96f67f81a0f
SHA1 d0ee4790970feecec536016d3d6afe3dc051c111
SHA256 a34768a77471a67f19ee977886bd065fb9eacf3a7e498332e2f2b3cf3332457d
SHA512 73f99b2025d53eefc88069a729ce872c7f572bded1e7851d0dd3a40fef00d0b0263eb71b1d2810fdb5caec6efe2a5c3fbb6d4afd18b5b5410fd53b4b000c433d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\searchBZUCIHL2.htm

MD5 ce7d672006f1048f97cd29c31f3601fe
SHA1 c39df70c396bd1a0b8feb0cf6f7e417c0ecac3fe
SHA256 29806420b40068168ef56af93db2f7c53f8d1a7f038815f57451f5c3fc62609a
SHA512 09284b4b2313d279fafc03f0f11422487fe52150b0147c7e7e09d3b7d9c0d263b4321dfa361651970df16dcaa083270862cb86b63d3fec64c474101958937937

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\search[3].htm

MD5 276e62a951ff00dfd054cadb067d4602
SHA1 0a56e0c8ce4a0018942095d3d0baf2b83ec9b17d
SHA256 fd0bffcd5eabaf961070ed6719d7da79e05998102e6a0453e107652793328527
SHA512 26e9b9d7c4f71a6886398a8a67a1a202eb9c1d904ee40ded6bd566c5c18178b4b7591522f056001a95e6920c874897d1902ad9de58ab4a5726fb98886d429bf7

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\search6BZW9PR7.htm

MD5 4ff98f8e3d5210bfdca1ee3159b9b809
SHA1 9ac7f642f82243751254dde27a609ec62c580e74
SHA256 589648ed2d2075bb986592351a28fc3e63cca2a62cc2f448f6eaa6e3859aac3a
SHA512 b0bcceb14ac1f5f14b01086619431b9b5e0bcd537077c20f886163277afe955f8209c9169bce134ad660187a856f01a1a86d494bdf5cb48e9626b38d18c62f2d

memory/1188-723-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-724-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\results[8].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\default[3].htm

MD5 c15952329e9cd008b41f979b6c76b9a2
SHA1 53c58cc742b5a0273df8d01ba2779a979c1ff967
SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA512 6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\searchSBIN7T4Z.htm

MD5 a08bc898ef9dc4e8a7ac301d1d0d21b5
SHA1 1a40cfdaa171ac9a2aaab503f4b6291e552f8935
SHA256 88c6bffbd4b9e8ab1ed2f09b3fd669f5eef3253af40eba4aeccae1fdf591f16f
SHA512 49a7222f43b876a17a0b90d064878988dabe519b8f47f05f71c55eeeb8dfee84df079349b1b3d7260f60233fa0fb950e753e9378e331b253e045c4d7218c1190

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\searchO1ONNAP1.htm

MD5 27b40eb7babaaf7bc69b47b6dba9da6c
SHA1 62e87328e427cd06cee88b62151903d0703d39c1
SHA256 c81bb92497f033db2dbbce339e6350ba5d196ec3da88ce4dce48dabd638a06b4
SHA512 500db9302516dc290084e7368cbdfbcc862406c9da6f16d94358f13e12e8a086a89e027d99f525c02b264208e553bc6d5c9c3ea09998f9e634f2030518aeaf3b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\search4TY661IE.htm

MD5 a4a02ad6c5dfb037724b2d2958c6617d
SHA1 6fb5d536b3750c8ccd7b1f93a41d84efbfa57bc6
SHA256 03ffc1ea7a030621ceaefe903b6add18add9ef17244b192eefd5fffd013f240f
SHA512 62b28eda453333d4ba9830d0ade9b1e464d75346c52daf53f0cb56b6e5bebea680d146e0fc73c1eeb863debc31184280419ef75c9e81795dc46310b246e5c49a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8ZO46T3J\results[6].htm

MD5 7a332319b4c67a0c2b49c9fb95a8b533
SHA1 a73a00ba83953575917a2060c009253fc0db93c4
SHA256 3c0cf785ae4898fab36c8e6e6d1ff44a1b980db0216539cc895157efe273da2d
SHA512 e057941f8e9e7f686dda89bd88a6781bdfa6d7f4545c3ad185ebf0a9828b29789f91a616f5eabe0c7c1cdfd9dfa46f443564e9cfc36de6b04f03dfd6ab67f100

memory/1188-875-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-876-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BHC2O5WS\default[10].htm

MD5 cde2c6ec81201bdd39579745c69d502f
SHA1 e025748a7d4361b2803140ed0f0abda1797f5388
SHA256 a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512 de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 51cb0669bca399ec91c7dca95b266afb
SHA1 b001cd0acb3b8d8989327d509af7baf7eb9edd3c
SHA256 8ab18d5a371c18b8f8321e7d87c2fd26718a98b19c5c750e045c11374e238166
SHA512 4d4049654c6eb4bfad6ee4341b9b5bbba1be36a10d5d1b70cce8cd46bc758cb03131f92e08a667dd3bb522281b2d1ea37f438930e91656ef7c2cadddaa954fbc

memory/1188-1030-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4384-1031-0x0000000000400000-0x0000000000408000-memory.dmp