Malware Analysis Report

2024-07-28 10:40

Sample ID 240614-v4j2sszenh
Target aaed65dc2a39fef8258906a021e9f781_JaffaCakes118
SHA256 15976459a4b7809c4ff80ae8990f4f092a129a08759381037a5a6ba69ceb173c
Tags
persistence upx microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

15976459a4b7809c4ff80ae8990f4f092a129a08759381037a5a6ba69ceb173c

Threat Level: Known bad

The file aaed65dc2a39fef8258906a021e9f781_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

persistence upx microsoft phishing product:outlook

Detected microsoft outlook phishing page

Executes dropped EXE

UPX packed file

Adds Run key to start application

Drops file in Windows directory

Unsigned PE

Modifies system certificate store

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 17:32

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 17:32

Reported

2024-06-14 17:35

Platform

win7-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2280 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe
PID 2280 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe
PID 2280 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe
PID 2280 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
US 15.198.7.40:1034 tcp
N/A 10.0.0.32:1034 tcp
US 16.18.10.121:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.8.32:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
IN 4.240.78.106:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 75.2.70.75:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
IE 159.134.164.135:1034 tcp
US 8.8.8.8:53 mx.gzip.org udp
US 15.204.154.223:1034 tcp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 mx-in-rno.apple.com udp
US 17.179.253.242:25 mx-in-rno.apple.com tcp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
SG 74.125.200.26:25 alt3.aspmx.l.google.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 16.102.1.35:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
BE 23.14.90.74:80 r11.o.lencr.org tcp
BE 23.14.90.74:80 r11.o.lencr.org tcp
US 8.8.8.8:53 smtp.gzip.org udp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 email.apple.com udp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 mx-in-vib.apple.com udp
US 17.57.170.2:25 mx-in-vib.apple.com tcp
US 17.57.170.2:25 mx-in-vib.apple.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 insideicloud.com udp
US 17.57.170.2:25 mx-in-vib.apple.com tcp
US 8.8.8.8:53 insideicloud.com udp
US 8.8.8.8:53 insideicloud.com udp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 id.apple.com udp
US 17.57.170.2:25 mx-in-vib.apple.com tcp
US 8.8.8.8:53 insideicloud.icloud.com udp
US 8.8.8.8:53 mx-in-mdn.apple.com udp
US 17.32.222.242:25 mx-in-mdn.apple.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 17.32.222.242:25 mx-in-mdn.apple.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
GB 142.250.187.196:80 www.google.com tcp
FI 142.250.150.27:25 alt2.aspmx.l.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IN 4.240.75.51:1034 tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 itunes.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 17.179.253.242:25 mx-in-rno.apple.com tcp
GB 142.250.187.196:80 www.google.com tcp

Files

memory/2280-0-0x0000000000500000-0x000000000050D000-memory.dmp

memory/2280-4-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2392-11-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2280-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2392-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2280-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-27-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-35-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 9e8418b010f4efa779f1e46baf07d53f
SHA1 b1e420081d3d7d23d485250d6231567399ac8a79
SHA256 ab83ef217b9724a4c4b15d8184753d02adbcee69f6228d0aa5b25a8c87b438d1
SHA512 4b3eb0a3e4f0ff08a78adafcdf7e552cecd518f6dbbc24e2bbf863a858cc2bc6a63de43875672b14590ecf4c0c0814a6b3375892cd8bb123429dee9125611c04

C:\Users\Admin\AppData\Local\Temp\tmp18A.tmp

MD5 4f6e63951275eed2d788f4635b457177
SHA1 cfb2a2b83fbda9d224cce4526d5c16a3022a8fd7
SHA256 441f1c3215af7bf7579038096432e0b5201762d401fcf461f79055cb64fac55a
SHA512 2eda3d930523a9f6b11958722a9c12c9322961b7168e610f6e9d213f86c8078702ba570fa4817fe25190313dd64a17a729205308dd5e4a7dfd22d51674485ada

memory/2392-59-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-62-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-66-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-67-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-71-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2392-75-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 57c961abba22df5b316c3d8c824d2bb6
SHA1 e140a923c1022513ec9eb10bbba9e4a6e040c7fe
SHA256 1b90c596445faac77c66423f7c3d8844d8d72ee85c02df6527584635854f766d
SHA512 9e55e94b536e46b182f32f884985948f2c669131b55f061ac24b8f856fed5556b3ddc35db56d89d06af502f8ae3d767d4dc6f83558723d981117194bca0b924e

C:\Users\Admin\AppData\Local\Temp\Cab54A.tmp

MD5 2d3dcf90f6c99f47e7593ea250c9e749
SHA1 51be82be4a272669983313565b4940d4b1385237
SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91998a77ff2198edf4ee45f8569d8eb3
SHA1 f6d64577c9fe26bf945496078e6aa01897c97326
SHA256 123493ea45ff581a173ee0abb240e0741c2e64adc65f8e79cfe4a2f144be3f08
SHA512 386b7a8b43dab5607ddea10bcd2f6182c85b57955262b8fed792799db6fed3b634237260ab429947582668f19655447c9e25915be710808de79594c628ac8217

C:\Users\Admin\AppData\Local\Temp\Tar60D.tmp

MD5 7186ad693b8ad9444401bd9bcd2217c2
SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d8651d1ee8c7b0655e0fb46d4c202f03
SHA1 ce92f2e7ea9a2ec64b1584cc346e550eeca33eaf
SHA256 cd6e02e1403eec301162c573daedd20c3ae9d908f3f04b44ab33665caa4f1cdb
SHA512 a087560b82f0253f796671728c01b3832931d7df53d9f791b5b13cbf1a1e1aed93e4fcdb29258eafec216ca0af6958fbdf99386b5916091c71824a20a51a8664

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\6AYQ1MM3.htm

MD5 af9cf648f93661d0e0a14ce49b1db2f7
SHA1 57fe43f8545d4ccc06850c284b967735314d21e5
SHA256 74d274afdc0a8f989ebe8afb20ebfe50048528150178dd7da784fbe95fd20dae
SHA512 8d76e2866e5545052576af442771954c7c417280d2af323c903617b330b2bcd63af4e1462b786ee54fd4010b475a39e9309d05c55b0119896c5858b0512e9ed2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\search[2].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\FNCFD86M.htm

MD5 9803a905a94cbc54f7a8698e07877a9b
SHA1 dfeaf2fdae6e61eb788bbf1ff1d377c8ab6d642d
SHA256 c06e985cef7389ddc4d862a749b6ffd56be546199e88da07ad29d1e338c53f31
SHA512 5b86e8fbc575979825b5cb90db54a86b63916d8536d5413dba1899cfe97f3dd4c9997cec3de818e183962e6a08e258e623cad8a392f881ba70ad842d2e070932

memory/2392-256-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\search[3].htm

MD5 b4b58a7f5bd188cd41cac5f58f5e3a0a
SHA1 9bf8df77176ebad57875d40a519dc182c156852a
SHA256 33d4ca89d536d6e3601237ead15ce1082a77d29fed9273d0508fb149aa34ae19
SHA512 514561149a5a8105fc487b8d8d629b0a6920e0db9c6c425e15cb658a17c68252ccd45c7e0af93c2a3703951336675bfbbf883d2eda087dc34ccae59d58f824bb

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\results[2].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\results[4].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 b6318ddad6a5f9674ed1c62798dc7e35
SHA1 d38232d8dc07180bd74bc990335df9a9cb7a53ad
SHA256 0a22c081d0b554959a1820c94d7b6a296e5621577e6d6be421ad6dc21aa8a144
SHA512 55a95d855b28fba363676939db447e5fd27c87cb419500efc5ed54cd23634435426c937494a2823f80d68c810e469f2efc8c0156d3641bd92cc8c7764111d76f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FY3LN490\search[5].htm

MD5 93f7b1cd9ad3bc8e353fd2b1bf824d18
SHA1 21d0a7358d9640098d0deadb1249baf3c3710b2b
SHA256 887ca1ec25dad094456651c19d74a67be44946252bef9e05dcff97dcf7f15186
SHA512 e68e6a413122324096ea33224c2e470104113df8eaad20d8cdabf870c7ef45b0b27d9b9f24dda2b0eaed9e2c0b4d29320fb43ad55b2932bf5d614b532b8ca5ea

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1M46YZP1\search[5].htm

MD5 f08d5f0cfdd60d69cacfb631061b3b50
SHA1 74d47c19b81505accbe80c9ddc59ecc8d78cff36
SHA256 b3e03361ede5ec064c916d03c31d5987f02a89aa6c84c57bfbed6ab3e4584cec
SHA512 55ff8e1b0535da08875669d12b4000aa66a8cc7545fb78ad7d9502354a7ee219b210372ab54df375c214fbeab882b7e5f14d64b755fedaea61c7dc41b7bc34ed

memory/2392-475-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1M46YZP1\search[8].htm

MD5 a0dea722fd1026623cc7820b474481b9
SHA1 57ef896b89b9fd67cc5b8d2c23f9f5b5832780d0
SHA256 0bda1ff669fdb1e95c14046fab36911e6155c1d10dbb0de55fb718d526997728
SHA512 fa0fecc92778a2816b98ad1dc36356adb6faa7a2cd4c793491988e7504974e39bfeb221d7c234f18cdbe2b9cb2c609a5806d1977bce11af747e883b4f25e0d8f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\search[10].htm

MD5 2eba7c8b41ac5b481fc4e510e428cd9e
SHA1 b9ef730f6f79629a48920e50f9970310e5a68c59
SHA256 47b239cd8e05556a95863f38ef9f34c891c2e434d39d178b8e1089b06e8537a2
SHA512 ea4c892003b37fec6597ae5f26861a6fbc59153484aca50de7dd6687297d980c84beb4720bfd8880a7760680caf89eba63f0360cc55e7c47e8484ef522d42956

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R54TGSS0\searchXUTH0L4S.htm

MD5 91453140fb7c4eaa12a79d5ba8a86e46
SHA1 8a93a6c6153ccac5ca61d90be671d7bccebb9396
SHA256 d32629ca676f3b70abd0bb211371781eb8400346fd60db244a0942f2bc2b32f0
SHA512 9bbb7e085bff41f8b0482d66f51c666b8269e3160480c35df182f41d043c80b6ddbac1625e26f6860e23b08dc81f574c455b7ee94fc522b74f09a4dfadd57656

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 6bfb424fe05550819201d686f3339cd7
SHA1 7b42352f53921a0ea8b6ede68ffed78bd46307d8
SHA256 4dd856fe6d0545e24aa46f1966ca608af628578b8622541467d8bb880c47766c
SHA512 ab1549c781373b73034410dfa4c6d394305bb13d4d837e64f0e73db07bc2d8be14ff81d9c07c4d15ebc20be2d6ba756eee2ec556de843f72e6dcea66d5a89be9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 17:32

Reported

2024-06-14 17:35

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\services.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
File opened for modification C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A
File created C:\Windows\java.exe C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2068 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe
PID 2068 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe
PID 2068 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe C:\Windows\services.exe

Processes

C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\aaed65dc2a39fef8258906a021e9f781_JaffaCakes118.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,4778049104057176787,6631751660692402210,262144 --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:8

Network

Country Destination Domain Proto
US 15.198.7.40:1034 tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
N/A 10.0.0.32:1034 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
NL 52.111.243.30:443 tcp
US 16.18.10.121:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 alt1.aspmx.l.google.com udp
US 8.8.8.8:53 acm.org udp
NL 142.251.9.27:25 alt1.aspmx.l.google.com tcp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.1.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.51:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.194.17:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 www.google.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
BE 23.14.90.96:80 r11.o.lencr.org tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 96.90.14.23.in-addr.arpa udp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 butler.edu udp
US 8.8.8.8:53 mxb-0000ca01.gslb.pphosted.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
US 208.86.201.66:25 mxb-0000ca01.gslb.pphosted.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IN 4.240.78.106:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.251.9.26:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 99.83.190.102:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 mxa-0000ca01.gslb.pphosted.com udp
US 67.231.148.203:25 mxa-0000ca01.gslb.pphosted.com tcp
IE 159.134.164.135:1034 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 aspmx3.googlemail.com udp
US 8.8.8.8:53 mx.acm.org udp
FI 142.250.150.26:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 65.254.254.51:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 52.101.11.6:25 outlook-com.olc.protection.outlook.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 butler.edu udp
US 3.211.89.216:25 butler.edu tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 15.204.154.223:1034 tcp
US 8.8.8.8:53 aspmx4.googlemail.com udp
SG 74.125.200.27:25 aspmx4.googlemail.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 mail.burtleburtle.net udp
US 65.254.250.102:25 mail.burtleburtle.net tcp
US 8.8.8.8:53 outlook.com udp
US 52.96.223.2:25 outlook.com tcp
US 8.8.8.8:53 hachyderm.io udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
IE 212.82.100.137:80 search.yahoo.com tcp
FI 142.250.150.27:25 alt2.aspmx.l.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.butler.edu udp
US 8.8.8.8:53 mail.butler.edu udp
US 8.8.8.8:53 smtp.butler.edu udp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 16.102.1.35:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 aspmx5.googlemail.com udp
TW 142.250.157.26:25 aspmx5.googlemail.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 mx.cs.stanford.edu udp
US 8.8.8.8:53 mail.cs.stanford.edu udp
US 171.64.64.160:25 mail.cs.stanford.edu tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 smtp.burtleburtle.net udp
US 209.202.254.10:443 search.lycos.com tcp
US 65.254.250.102:25 smtp.burtleburtle.net tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 8.8.8.8:53 mx.outlook.com udp
US 8.8.8.8:53 mail.outlook.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 smtp.outlook.com udp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
GB 52.97.146.210:25 smtp.outlook.com tcp
US 209.202.254.10:443 search.lycos.com tcp
SG 74.125.200.27:25 alt3.aspmx.l.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 kinoho.net udp
NL 142.251.9.26:25 aspmx2.googlemail.com tcp
GB 142.250.187.196:80 www.google.com tcp
IN 4.240.75.51:1034 tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.187.196:80 tcp
GB 142.250.187.196:80 tcp
IE 212.82.100.137:80 tcp
US 209.202.254.10:443 tcp
US 209.202.254.10:80 tcp
GB 142.250.187.196:80 tcp

Files

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2068-0-0x0000000000500000-0x000000000050D000-memory.dmp

memory/224-7-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/224-13-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-22-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-26-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 9c892d70026bffeeea4e6f2c427a056c
SHA1 56f4b2a950a7b55820ad20061d200609377671e7
SHA256 3800ed76c668514ba40a773375c1bb4c1a4eb5ad23b11f477da803679f5e6815
SHA512 6bd74cc82c7dbecca93d2e73b0de43c024c6e2fe070836ded0ea1e7701dcdcec652809a4e84b7abfe592f4253ac72c9ee261bb48e9bca18ab37d6af8e1d1bab0

C:\Users\Admin\AppData\Local\Temp\tmp9B62.tmp

MD5 6ccee3a10ebfdc79fb20097faab5a406
SHA1 564d4c41c1183bfbaed63b03584d67b8dde3f2b1
SHA256 63ac90d8360006035c58e1d671f0a03b6f3f6b71b30c99d98f341ba33cfe59c4
SHA512 69802dfca19dddb60563200a9cf90057b055925210134ce263ac539b18f584055fb1ed26f8f8c17a6a03133f22939754d25653eddfb7e9e9e34861c36e49f94a

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\XHI0L3JR.htm

MD5 7a660878215f6b798d0fc4d9c8d97f85
SHA1 5696e511b5b65668fbf333ee4caf681bc28a26a6
SHA256 a3d715c8593dab5407c066be6d21c2da5fec376145aba0e42957ae023a244548
SHA512 252a5bc0fa776289783fee770ceae20b7d91aa21ff491ce63837100b4a1e3f260e6f9ca12f8f25366fbdb73c4d98298b8c3150439cfd7452c1d44d090b6074ed

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\BA9JCSH3.htm

MD5 3facc4672b4e30e8c7f7e2cc08771fff
SHA1 aa77aadace637f60ecb02c0b4498e6823df6e624
SHA256 52cf4fe3127437efc79b76fc3445d1648159f3bdce14d21c1806e2d133a5031b
SHA512 cdfd71230a07df7d969b676e0a6fe7a9add2e3bea588cc2069d0b5138947d6802a7d38ae5f4d2bf526a3d15fb08eca191b501c23c28bacc8a89d7e5fffd4810b

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search[3].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\search[3].htm

MD5 57bfe126a4a2ab5b89b9731f8d8bd856
SHA1 0ac903eee9854e4635d30bfdf7a584b34ad86050
SHA256 19a60c35d46fcd043cfcf0cc93df2be82550009d55479d129af411f721dcc4b6
SHA512 b42506cef7775c6699202beabb3efffca32b201c9e78087b43616c7860b44ed3c44ebb8d1b5801a92bd8fd007dbd8df11b23a1d41c93e389ecc1668ab5fe14a3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\search[2].htm

MD5 0d54b4ec78d37e966c5c1d6ac10e9af7
SHA1 2a73a0556d3645e72ad68654d87aa9e169b43a5b
SHA256 0d3783e53ab229c529a392394de8949cc77fa3c0d673218bf2806f9fa060af45
SHA512 004d100a42eefa58f238835aa840836d62a35bbc60b4f924f9eb3cea01f9b79f55ea55902b0d8721b75d8f3406887c80ad9f89a3be9cc906c5185b7e37baf2f0

memory/224-203-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\search[1].htm

MD5 5743a51f9c653ff8ba89d424a44d892b
SHA1 f9bea0893eb645679e3c5f98507e4640c83b3542
SHA256 9cd5bef4b53f7160f63ea2ed8b312c7e20b96e2520d1931529fde3e28deaffb8
SHA512 b56f62ca1a3c89b393b1c00d0e93380b1cc6daaf2d0076df4faf9526a201418e1b50719731fd65c7d164220d538d6037f24832387fdab13c30104e6f551a4695

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search[6].htm

MD5 e32d098dafc3779379a5b176b0523d81
SHA1 0417c5bd9df51b5e53d1f4998ea745637a254855
SHA256 8510a282783b7135a290636e8320750d4116606ff89ed17ed6fb9a4dc3e47725
SHA512 13767ef62c2dbd277f15e41cda7e33ca0dc6dbe5ce6e400da94805230722028dbadeb5c7b6631703ac0ed7dc1b5ee7707de0fb513dc68e448467e9a11164a40d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\search[8].htm

MD5 30e045421c34eccd4994476decd171e9
SHA1 06e330a8ff76d75824cbcd813190c843738d1ff5
SHA256 6fd58c2358d3f2705bc208fe3b9902b271b8c325141a9681c360988a090bdf53
SHA512 6eb1d5b7de980a9b0fc909c39fb976bb57df64908f2fcb9d95790adfd6be87157dc68220e1c4112eda6b28bdb113c2c048f93fc86ae3c3cf7ff7281fba333cbe

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\search[7].htm

MD5 cfe415c44324e2b788ebcbc5345f30cd
SHA1 032317e618df4b1d0eb90118c9bd4d8877d8244d
SHA256 6aa187e65da5068ed5650e67c74e139263dc3ab218d6228c926828f8cdd4c84b
SHA512 f7b0d4847d16a11077705cb0c2d2b83a24c99ad6a761214f0646ca3261a204bb746b4c7d94100f87d923447b755deceb9f985389d27028f9822ad3ec3b0ee909

memory/224-276-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-280-0x0000000000400000-0x0000000000408000-memory.dmp

memory/224-284-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 2c3d37cea111e51fa4931abf33e7631c
SHA1 ca690ddd6da5f0c9da639810a37a67c7e6b4e23c
SHA256 79d4948c708d28dfea7c87439af5e916a04e3c02361e8428872c13a0e75d0126
SHA512 aa5afb071e822e602585b1b2862cf3fb3c38d0ede41802831c38f30ebd2e1f07b321a1727bfb403492d510e456b2287534fa77340b6c11c8a65f17f3749834e9

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\results[4].htm

MD5 35a826c9d92a048812533924ecc2d036
SHA1 cc2d0c7849ea5f36532958d31a823e95de787d93
SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
SHA512 fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\search[6].htm

MD5 796d74354bb2d0439d09b4a35a3dfec7
SHA1 8686b500e086073b8b3c47bf7fddc1367d970104
SHA256 f307bf9ad7b724ef661e18f3a53da3cf3b9910f8fd49a436b0f204eee71d7e94
SHA512 cab3d3e0935d78bde025322691017237e5621cd6ee1e64821c3a9dbc089a40ed7934fd56d5fc16f3feed47ef05a64d4b2a62be9667bd193f9ff9e20f13d45c06

memory/224-361-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\results[5].htm

MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

memory/224-421-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 35d008fe5a732d6b7964e4004afdfda1
SHA1 fec87b3080b1aa0a71216b2f09312769c560b984
SHA256 630918574b2de5b93eaca93764cd418d01e777fca38cf33457909d674ed506c8
SHA512 2e957abc65dde0773fa79385f5815d54f40187ca7aa31df360ed034df00e75fc37be1030f41b43b2a171a957476a42adebd671d97d12a8c6711791cfc1aa5d3c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\search8VVBRDON.htm

MD5 0ae3425cf637476f5fb5f6ec8e6bafab
SHA1 e29847fa4184ae1e4052d35ca8c28837be555e5d
SHA256 c4d95064c24a1a3d4c80a20e4fc45df622f8259cf49e88a8e6f51f8a6e934a2a
SHA512 668516c20e03a24f0bb3c60e50a0e57ea49ef668ce109f04aa317f7fe674bd7a2b6e34af9ece0456bc77658b54804240ab5c471f13c8341b9775427878441169

memory/224-503-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\searchZC9BUSAM.htm

MD5 ee004322c695353f64c9345fb3c4267b
SHA1 56d91e62d8a44f1363d01bd755392928d604dcc3
SHA256 775df4499094f3d96a994c4bc8c779ad2663aa04fbe906333b000317c0f91215
SHA512 a5548c7694115502d8f3d75c5bda35647f7984c2a8363a82b599c22004b43ba7545476d5381066f92fa3c00d5c0490d2473697510d0797a2d1d729392741489d

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QZRYTBAT\searchU7XWHIC2.htm

MD5 ac1b51931fafa0171b95593dc65e6127
SHA1 ccf121e8487527f3986ca67b872a3129943d4360
SHA256 2f5c9a123b2137b4b8f1b5fa46fc124ed93f375cd67ab5781b87b4ca5c73799e
SHA512 3765ccc843d0554cac8ee004fdfd877f4cd636448a2575fdaeb2c67465beccb6d84072c639982bc35cfc2228c850baf2d0dd96b1f3e76ce03888bdc109721ef6

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\search[3].htm

MD5 b63468ed7bbc0ecb063fb2338b170be2
SHA1 7c1e7e3dc54ec9efe052b5b04c796c8f88a27706
SHA256 92806431d25a94a20dcd926e66b4f8fc42697e7d3c0bbc786094d3f3d1811457
SHA512 d3c1ffca556dff3fa9413592c1e2cc833f81cda8744b2f0490cd0bcc485d6052fa2636131a15d103ea214bf4151b1d4e2f2454e39bfbcd6beafe7595a07e9049

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\searchQ23YKD7T.htm

MD5 75c7acd78fdd995ee63f1050629326c9
SHA1 5f57e72e526c08f5d6d8d65e4312e0dcc3f0c7c5
SHA256 bb2179a6c4da49329be5dd93f1f8ca8e9fc1e6fae7e3b24cfa0b8cd141039f29
SHA512 4544dae071621e4d93239167c42976c2d1aa60b3585032598f68370e57619259a665b960922da41af772950a6fb3ae692ac7a7314cf876b3764410d359fb4b36

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\results[9].htm

MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

memory/224-633-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\default[2].htm

MD5 2a8026547dafd0504845f41881ed3ab4
SHA1 bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA512 1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\searchXXG6NABY.htm

MD5 a13c6fc4886eba30b47e58ee315d989c
SHA1 4122493acf9b651c2523d96b51d408f5cd61953c
SHA256 7cdf73846fe808b7b5ea9b991a32d38d4673b8abc19042a256057ef8f33cafc3
SHA512 6968b51e47c1fb2e60a724037dddeccf5fe1de95dff8f2e268a73898307ef013ded0a7f60c630dd5c0c09603cef279a10ed208722acd23b3af99a9ebe7e50ca0

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\searchRV32LDH7.htm

MD5 d66cb871ed55244aabdff43cb29183bf
SHA1 fe497fcc949e3fe0b983109301ba760720f33164
SHA256 5cb6c4ee3b76575bdfbc6298f8aa43bfe1f3205302032c5c4fb46acfd900c1c5
SHA512 0250fa03c6a35856175958bb262cae7bcd8c6f6f286328e8bebc5567a73fb8077966b0851bfbc5d264231b28dc08696ee8a4ad50872837f5acc4d7c8cef2c3e3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\default[2].htm

MD5 267ddfdbb8d492b25de208d84b290f1c
SHA1 9f57d9f19f25549e1232489a0c101a92e851de2f
SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA512 0709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FUP7PRY6\searchJFY87IGR.htm

MD5 e0540cac6a14dc0f25d560cbdc2ec5ac
SHA1 78814b404a674f7f48faac2641d2d25113929d10
SHA256 4c7adcda77c31ec270fd18459175d87f61e6430d204b936b0d057127d0397a0c
SHA512 8bd42973245a30420af675ea0d650d1bbe33acd76655a8187011fd5979a69d74c28f08953ed42dd675fd90b827fa71403a821f9610ca68e4c64e919b8f52fe67

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\searchIJ5E00WW.htm

MD5 158418535d5b9c97be4256366795faea
SHA1 12692de4bd52e77b53af50a6b21cffb173a1bac3
SHA256 b177d981d411a4debb1d661e27b502935aafd99040d3530e2f1f576f92f14122
SHA512 7ef80fa57ff621fad9b4f4047d2b86b583568b2e775d545fe2ffcd6ec708927c2c89e2f3b5a9eb6a82698a9e18a8b7e2a302674980a95d586a6676e9afede762

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\search40LD3B12.htm

MD5 2a75634dbfe12f8c053aaa2495d23bfd
SHA1 c2211ed564eca9b8fa715d886ee38e31e415036a
SHA256 27b11accec87a0ef946bf8da3a4da178e1ef412e9c9d7f8efc3c7059d5d246c0
SHA512 b77af9f90c18bbcad7efba2524597df4d7f2ce7b4b2ebf1e3f9f0893feda9a7c9e99259431794bbd8a88159471bcbad17b546c538dc626949c787faac6f49431

memory/224-790-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RD8M0ENG\searchX4XMWF87.htm

MD5 fd92f25d831aba563ac0a1a77cf69eb1
SHA1 cabdc464afda0414eb0efaef5c724eca00d51fdb
SHA256 bb59cd9c8e7977d5ef9f667b46fd2e0fbc92101da29a0dfe4cd347db9c620d80
SHA512 5475b1ee6bd63f7fa3e719275ceeaad04b6149361e865ec30f1f8a91b8d153c5d40941c38163c90107cce9387053dc7a3bfedd24a456b2980824e3723cdb3c53

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SYNNS6ZU\searchG3F47NV1.htm

MD5 3bf519f59e98cc4669d51b51dd4cc161
SHA1 46c1f8944710de26ba0e293c7860d8da338f4731
SHA256 964593ef669e3405f4fc14a019f27f4f5aacee6f52746a733b08cd7881cdfe04
SHA512 30021a8809d1314305692ec6183828f9401cb5decc430dde9a6c7b3b691e1921292b8d9e804518926ca1485f92510c9c7a170156743bb7c8dfdfc2f6ff1f6926

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d71c98dbcbb8bd05dff1e486c3fbcb48
SHA1 9f1f41c57b0cd03932269fdeb78c2c321bc168a0
SHA256 7e70737e13d40b551f6228a57e5fa0cf4459d7c67f4ecdb7d977be2a7aaa2fc8
SHA512 cd0e3a408b39031366aa121f92c838f4c82387ed7ad5ab4066b79a5212a63a40123d2e561d62cb9735a2830961a1eb7cacf849741ccfeedd3624a4e50f172a4d