Malware Analysis Report

2025-01-03 09:07

Sample ID 240620-mk4yvswhrq
Target 052b5acac9c78bb52359688b64749ddd_JaffaCakes118
SHA256 76267082ac3a390b9f32632ad408aed8d66bb404f4fb9b1d68fce020c0930967
Tags
upx bootkit persistence
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

76267082ac3a390b9f32632ad408aed8d66bb404f4fb9b1d68fce020c0930967

Threat Level: Shows suspicious behavior

The file 052b5acac9c78bb52359688b64749ddd_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx bootkit persistence

UPX packed file

Enumerates connected drives

Writes to the Master Boot Record (MBR)

Drops file in Program Files directory

Unsigned PE

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-20 10:32

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 10:32

Reported

2024-06-20 10:34

Platform

win7-20240611-en

Max time kernel

140s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\SAItest.txt C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp

Files

memory/2540-0-0x0000000000400000-0x0000000000488000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab1D81.tmp

MD5 2d3dcf90f6c99f47e7593ea250c9e749
SHA1 51be82be4a272669983313565b4940d4b1385237
SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

C:\Users\Admin\AppData\Local\Temp\Tar3655.tmp

MD5 7186ad693b8ad9444401bd9bcd2217c2
SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

memory/2540-56-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2540-58-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2540-62-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2540-63-0x0000000000400000-0x0000000000488000-memory.dmp

memory/2540-69-0x0000000000400000-0x0000000000488000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 10:32

Reported

2024-06-20 10:34

Platform

win10v2004-20240611-en

Max time kernel

142s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe"

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\SAItest.txt C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\052b5acac9c78bb52359688b64749ddd_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 csc3-2010-crl.verisign.com udp
SE 192.229.221.95:80 csc3-2010-crl.verisign.com tcp
US 8.8.8.8:53 74.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 b.tubewhirl.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/536-0-0x0000000000400000-0x0000000000488000-memory.dmp

memory/536-11-0x0000000000400000-0x0000000000488000-memory.dmp

memory/536-12-0x0000000000400000-0x0000000000488000-memory.dmp

memory/536-16-0x0000000000400000-0x0000000000488000-memory.dmp

memory/536-17-0x0000000000400000-0x0000000000488000-memory.dmp

memory/536-18-0x0000000000400000-0x0000000000488000-memory.dmp