Play interactive tour

Edit tour

Analysis Report e1f063d6_by_Libranalysis

Overview

General Information

Sample Name:	e1f063d6_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:	411585
MD5:	e1f063d63a75e0e0e864052b1a50ab06
SHA1:	75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
SHA256:	8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
Infos:
Most interesting Screenshot:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

Modifies the windows firewall

Sigma detected: Raccine Uninstall

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Yara detected PsExec sysinternal tool

Classification

Startup

System is w10x64

e1f063d6_by_Libranalysis.exe (PID: 5964 cmdline: 'C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe' MD5: E1F063D63A75E0E0E864052B1A50AB06)

taskkill.exe (PID: 6092 cmdline: 'taskkill' /F /IM RaccineSettings.exe MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

conhost.exe (PID: 5436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 6240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5868 cmdline: 'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F MD5: E3DACF0B31841FA02064B4457D44B357)

conhost.exe (PID: 3340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 2508 cmdline: 'reg' delete HKCU\Software\Raccine /F MD5: E3DACF0B31841FA02064B4457D44B357)

conhost.exe (PID: 5624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5112 cmdline: 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6084 cmdline: 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes MD5: 98CC37BBF363A38834253E22C80A8F32)

conhost.exe (PID: 1000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5660 cmdline: 'sc.exe' config Dnscache start= auto MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 5112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6092 cmdline: 'sc.exe' config SSDPSRV start= auto MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 6232 cmdline: 'sc.exe' config SQLTELEMETRY start= disabled MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6284 cmdline: 'sc.exe' config SQLWriter start= disabled MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6324 cmdline: 'sc.exe' config FDResPub start= auto MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6364 cmdline: 'sc.exe' config upnphost start= auto MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6412 cmdline: 'sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6452 cmdline: 'sc.exe' config SstpSvc start= disabled MD5: D79784553A9410D15E04766AAAB77CD6)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6500 cmdline: 'netsh' advfirewall firewall set rule group=\'File and Printer Sharing\' new enable=Yes MD5: 98CC37BBF363A38834253E22C80A8F32)

conhost.exe (PID: 6560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6732 cmdline: 'taskkill.exe' /IM mspub.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6744 cmdline: 'taskkill.exe' /IM xfssvccon.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6764 cmdline: 'taskkill.exe' /IM mydesktopqos.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 6820 cmdline: 'taskkill.exe' /IM sqlbrowser.exe /F MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_PsExec	Yara detected PsExec sysinternal tool	Joe Security

Sigma Overview

System Summary:

Sigma detected: Raccine Uninstall

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F, CommandLine: 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F, CommandLine|base64offset|contains: 11, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe' , ParentImage: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe, ParentProcessId: 5964, ProcessCommandLine: 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F, ProcessId: 5112

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: e1f063d6_by_Libranalysis.exe	Virustotal: Detection: 50%			Perma Link
Source: e1f063d6_by_Libranalysis.exe	ReversingLabs: Detection: 59%

Machine Learning detection for sample

Show sources

Source: e1f063d6_by_Libranalysis.exe

Joe Sandbox ML: detected

Source: e1f063d6_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: e1f063d6_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: Yara match

File source: dump.pcap, type: PCAP

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.6
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29

Source: unknown

DNS traffic detected: queries for: www.poweradmin.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

System Summary:

Source: e1f063d6_by_Libranalysis.exe, 00000000.00000000.233109888.0000000000616000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamegVcWDWENI84 vs e1f063d6_by_Libranalysis.exe
Source: e1f063d6_by_Libranalysis.exe	Binary or memory string: OriginalFilenamegVcWDWENI84 vs e1f063d6_by_Libranalysis.exe

Source: e1f063d6_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process created: C:\Windows\System32\reg.exe 'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F

Source: e1f063d6_by_Libranalysis.exe, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, SmartAssembly.Zip/SimpleZip.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Security.AccessControl.DirectorySecurity System.IO.DirectoryInfo::GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/sJWKyMjQFWbP.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: e1f063d6_by_Libranalysis.exe, qYAjLWajCJpnf/sJWKyMjQFWbP.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Security.AccessControl.DirectorySecurity System.IO.DirectoryInfo::GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/bTJSgdVkQM.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/sJWKyMjQFWbP.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.e1f063d6_by_Libranalysis.exe.5f0000.0.unpack, qYAjLWajCJpnf/sJWKyMjQFWbP.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal72.evad.winEXE@48/0@4/100

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5112:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5436:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6560:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6752:120:WilError_01
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\a24f6fef-8c36-4314-91c5-2f98ae613662
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6240:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1000:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5624:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6332:120:WilError_01

Source: e1f063d6_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RaccineSettings.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "synctime.exe")
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RaccineSettings.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "agntsvc.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "mspub.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "xfssvccon.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powerpnt.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "mydesktopqos.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sqlagent.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "oracle.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sqlbrowser.exe")

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: e1f063d6_by_Libranalysis.exe	Virustotal: Detection: 50%
Source: e1f063d6_by_Libranalysis.exe	ReversingLabs: Detection: 59%

Source: unknown	Process created: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe 'C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F
Source: C:\Windows\System32\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete HKCU\Software\Raccine /F
Source: C:\Windows\System32\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\schtasks.exe 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config Dnscache start= auto
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SSDPSRV start= auto
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLTELEMETRY start= disabled
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLWriter start= disabled
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config FDResPub start= auto
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config upnphost start= auto
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SstpSvc start= disabled
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'File and Printer Sharing\' new enable=Yes
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill.exe' /IM mspub.exe /F
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill.exe' /IM xfssvccon.exe /F
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill.exe' /IM mydesktopqos.exe /F
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill.exe' /IM sqlbrowser.exe /F
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete HKCU\Software\Raccine /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\schtasks.exe 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config Dnscache start= auto	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLTELEMETRY start= disabled	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLWriter start= disabled	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config FDResPub start= auto	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config upnphost start= auto	Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: e1f063d6_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: e1f063d6_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Persistence and Installation Behavior:

Uses cmd line tools excessively to alter registry or file data

Show sources

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: reg.exe
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: reg.exe
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: reg.exe	Jump to behavior

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process created: C:\Windows\System32\schtasks.exe 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process created: C:\Windows\System32\sc.exe 'sc.exe' config Dnscache start= auto

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Window / User API: threadDelayed 4122

Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe TID: 2016

Thread sleep count: 4122 > 30

Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: sc.exe, 0000000D.00000002.260521976.000002B9A8140000.00000002.00000001.sdmp, sc.exe, 00000012.00000002.261933051.0000020DB5E60000.00000002.00000001.sdmp, sc.exe, 00000014.00000002.263192916.000001D5AE8F0000.00000002.00000001.sdmp, sc.exe, 0000001A.00000002.266702255.0000020542C30000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: sc.exe, 0000000D.00000002.260521976.000002B9A8140000.00000002.00000001.sdmp, sc.exe, 00000012.00000002.261933051.0000020DB5E60000.00000002.00000001.sdmp, sc.exe, 00000014.00000002.263192916.000001D5AE8F0000.00000002.00000001.sdmp, sc.exe, 0000001A.00000002.266702255.0000020542C30000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: sc.exe, 0000000D.00000002.260521976.000002B9A8140000.00000002.00000001.sdmp, sc.exe, 00000012.00000002.261933051.0000020DB5E60000.00000002.00000001.sdmp, sc.exe, 00000014.00000002.263192916.000001D5AE8F0000.00000002.00000001.sdmp, sc.exe, 0000001A.00000002.266702255.0000020542C30000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: sc.exe, 0000000D.00000002.260521976.000002B9A8140000.00000002.00000001.sdmp, sc.exe, 00000012.00000002.261933051.0000020DB5E60000.00000002.00000001.sdmp, sc.exe, 00000014.00000002.263192916.000001D5AE8F0000.00000002.00000001.sdmp, sc.exe, 0000001A.00000002.266702255.0000020542C30000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\reg.exe 'reg' delete HKCU\Software\Raccine /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\schtasks.exe 'schtasks' /DELETE /TN 'Raccine Rules Updater' /F	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config Dnscache start= auto	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLTELEMETRY start= disabled	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config SQLWriter start= disabled	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config FDResPub start= auto	Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\sc.exe 'sc.exe' config upnphost start= auto	Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe			Jump to behavior
Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Process created: C:\Windows\System32\taskkill.exe 'taskkill' /F /IM RaccineSettings.exe			Jump to behavior

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe	Queries volume information: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the windows firewall

Show sources

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe

Process created: C:\Windows\System32\netsh.exe 'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation11	Windows Service1	Windows Service1	Modify Registry1	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter1	Scheduled Task/Job1	Process Injection11	Virtualization/Sandbox Evasion2	LSASS Memory	Virtualization/Sandbox Evasion2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Scheduled Task/Job1	Disable or Modify Tools211	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution1	Logon Script (Mac)	Logon Script (Mac)	Process Injection11	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
e1f063d6_by_Libranalysis.exe	50%	Virustotal		Browse
e1f063d6_by_Libranalysis.exe	60%	ReversingLabs	ByteCode-MSIL.Ransomware.Thanos
e1f063d6_by_Libranalysis.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
poweradmin.com	0%	Virustotal		Browse
www.poweradmin.com	0%	Virustotal		Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
poweradmin.com	52.1.55.52	true	false	0%, Virustotal, Browse	unknown
live.sysinternals.com	unknown	unknown	false		high
www.poweradmin.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.248
192.168.2.127
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.241
192.168.2.120
192.168.2.121
192.168.2.242
192.168.2.137
192.168.2.97
192.168.2.138
192.168.2.96
192.168.2.135
192.168.2.99
192.168.2.136
192.168.2.98
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.254
192.168.2.133
192.168.2.93
192.168.2.255
192.168.2.134
192.168.2.92
192.168.2.131
192.168.2.95
192.168.2.252
192.168.2.132
192.168.2.94
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.223
192.168.2.102
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107
192.168.2.228
192.168.2.221
192.168.2.100
192.168.2.222
192.168.2.101
192.168.2.220
192.168.2.236
192.168.2.115
192.168.2.237
192.168.2.116
192.168.2.113
192.168.2.234
192.168.2.114
192.168.2.235
192.168.2.119
192.168.2.238
192.168.2.117
192.168.2.239
192.168.2.118
192.168.2.111

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	411585
Start date:	12.05.2021
Start time:	02:23:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	e1f063d6_by_Libranalysis (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.evad.winEXE@48/0@4/100
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Excluded IPs from analysis (whitelisted): 104.42.151.234, 20.82.210.154, 204.79.197.200, 13.107.21.200, 52.255.188.83, 92.122.145.220, 23.218.208.56, 92.122.213.247, 92.122.213.194, 8.241.90.126, 8.241.82.126, 8.241.78.254, 8.241.89.254, 8.241.88.254, 52.155.217.156, 20.54.26.129, 20.50.102.62, 172.217.168.68, 20.49.223.105 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, sysazlive.uksouth.cloudapp.azure.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, www.google.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, sysinternalvmss.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:26:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.69311631555943
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	e1f063d6_by_Libranalysis.exe
File size:	145920
MD5:	e1f063d63a75e0e0e864052b1a50ab06
SHA1:	75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
SHA256:	8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
SHA512:	25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
SSDEEP:	3072:stjs/3uSKCHtJJlvRCKnel9XBZorbISN1qfR5FA+beml:stoFLJlvBk9xZorbISHo/A+bd
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1.`.............................L... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x424cfe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609A31A7 [Tue May 11 07:26:31 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24cb4	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x6e5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x28000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x22d04	0x22e00	False	0.593981014785	data	6.73843222711	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x6e5	0x800	False	0.37451171875	data	4.12292302953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x28000	0xc	0x200	False	0.041015625	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2605c	0x364	data
RT_MANIFEST	0x263fc	0x2e9	ASCII text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019 CU1dE2XqGn
Assembly Version	4.5.0.0
InternalName	h6fhhMtoyZ
FileVersion	4.5.0.0
CompanyName	glI2R3Bj9w QulOQ4bWqM
LegalTrademarks	s3pYFSAXn1 TYhO5t4LOp
ProductName	dfZfk9SMuk
ProductVersion	4.5.0.0
FileDescription	SQL Database
OriginalFilename	gVcWDWENI8

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
05/12/21-02:24:29.324944	ICMP	382	ICMP PING Windows	192.168.2.7	192.168.2.1
05/12/21-02:24:29.324944	ICMP	384	ICMP PING	192.168.2.7	192.168.2.1
05/12/21-02:24:29.324980	ICMP	408	ICMP Echo Reply	192.168.2.1	192.168.2.7
05/12/21-02:24:35.390738	ICMP	382	ICMP PING Windows	192.168.2.7	192.168.2.255
05/12/21-02:24:35.390738	ICMP	384	ICMP PING	192.168.2.7	192.168.2.255
05/12/21-02:26:16.527846	ICMP	382	ICMP PING Windows	192.168.2.7	192.168.2.1
05/12/21-02:26:16.527846	ICMP	384	ICMP PING	192.168.2.7	192.168.2.1
05/12/21-02:26:16.527889	ICMP	408	ICMP Echo Reply	192.168.2.1	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 02:23:58.761101961 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.761143923 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.761313915 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.771115065 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.771169901 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.818166018 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.861675978 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862382889 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862416983 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862443924 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862468958 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862490892 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862514973 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862538099 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862550020 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.862560987 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862588882 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.862633944 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.891594887 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.891683102 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.941626072 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.978168011 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.978198051 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:58.978297949 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:58.985421896 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098439932 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098474026 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098488092 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098500013 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098516941 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098534107 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098550081 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098566055 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098586082 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.098684072 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.098735094 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.128380060 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.128449917 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.175324917 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.217367887 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329720020 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329781055 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329824924 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329865932 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329906940 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329909086 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.329947948 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.329988003 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.330001116 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.330027103 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.330066919 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.330070019 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.330158949 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.360280991 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.360349894 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.364131927 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.364173889 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.409573078 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.409595966 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.415081978 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.415106058 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567116022 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567157984 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567182064 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567205906 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567229033 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567253113 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567267895 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.567280054 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567295074 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.567310095 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.567310095 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567339897 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567379951 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.567823887 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567850113 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567873955 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567898989 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567919970 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.567923069 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567948103 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567971945 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.567995071 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.568006992 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.568018913 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:23:59.568068027 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.619337082 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:23:59.619352102 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:24:55.459692001 CEST	80	49680	93.184.220.29	192.168.2.7
May 12, 2021 02:24:55.461400032 CEST	49680	80	192.168.2.7	93.184.220.29
May 12, 2021 02:24:56.827115059 CEST	80	49679	93.184.220.29	192.168.2.7
May 12, 2021 02:24:56.827311993 CEST	49679	80	192.168.2.7	93.184.220.29
May 12, 2021 02:25:44.254055023 CEST	49679	80	192.168.2.7	93.184.220.29
May 12, 2021 02:25:44.254587889 CEST	49676	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:44.296401978 CEST	80	49679	93.184.220.29	192.168.2.7
May 12, 2021 02:25:44.296540022 CEST	49679	80	192.168.2.7	93.184.220.29
May 12, 2021 02:25:44.303159952 CEST	443	49676	20.190.160.6	192.168.2.7
May 12, 2021 02:25:44.303340912 CEST	49676	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:47.394809008 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:47.394896030 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:47.443438053 CEST	443	49682	20.190.160.6	192.168.2.7
May 12, 2021 02:25:47.443469048 CEST	443	49685	20.190.160.6	192.168.2.7
May 12, 2021 02:25:47.443623066 CEST	49682	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:47.443782091 CEST	49685	443	192.168.2.7	20.190.160.6
May 12, 2021 02:25:56.904874086 CEST	80	49680	93.184.220.29	192.168.2.7
May 12, 2021 02:25:56.905003071 CEST	49680	80	192.168.2.7	93.184.220.29
May 12, 2021 02:26:09.085006952 CEST	80	49680	93.184.220.29	192.168.2.7
May 12, 2021 02:26:09.085232019 CEST	49680	80	192.168.2.7	93.184.220.29
May 12, 2021 02:26:13.606247902 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:13.740448952 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:13.740575075 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:13.741137028 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:13.877072096 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:13.877103090 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:13.877120972 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:13.877182007 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:13.885706902 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.021519899 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.023221016 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160139084 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160197973 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160248041 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160284996 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160319090 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160360098 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160379887 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160420895 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160459995 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160478115 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160526991 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160571098 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160593033 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160631895 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160670042 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160696983 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.160739899 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.160797119 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.294975042 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295031071 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295069933 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295128107 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295162916 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295205116 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295254946 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295298100 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295345068 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295366049 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295422077 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295473099 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295492887 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295543909 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295583010 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295600891 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295639992 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295677900 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295697927 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295744896 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295788050 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295805931 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295845985 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295885086 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.295902014 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.295948982 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296001911 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296017885 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.296065092 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296102047 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296122074 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.296159983 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296200991 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296216965 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.296257019 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.296334982 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430295944 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430362940 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430408001 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430448055 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430474043 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430504084 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430537939 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430577993 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430618048 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430638075 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430679083 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430733919 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430747032 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430787086 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430824041 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430840969 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430881023 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430926085 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.430937052 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.430977106 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431013107 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431030035 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431080103 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431128979 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431140900 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431180000 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431227922 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431241035 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431279898 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431325912 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431338072 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431387901 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431436062 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431447983 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431488991 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431535959 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431550026 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431596041 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431652069 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431665897 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431715965 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431760073 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431778908 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431821108 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431859016 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431899071 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.431916952 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431957960 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.431977034 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432017088 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432054996 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432075977 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432126045 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432176113 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432193041 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432248116 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432290077 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432322979 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432352066 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432398081 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432410955 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432450056 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432487965 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432507992 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432555914 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432600021 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432636976 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432663918 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432703972 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432723045 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.432773113 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.432821989 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.566907883 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.566987038 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567049980 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567107916 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567157030 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567183018 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567253113 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567317009 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567373991 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567397118 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567441940 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567483902 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567522049 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567540884 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567575932 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567610979 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567660093 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567703962 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567744017 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567764997 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567810059 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.567825079 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567867994 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567907095 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567972898 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.567991972 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568028927 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568088055 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568134069 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568182945 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568238974 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568276882 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568335056 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568367004 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568409920 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568459034 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568514109 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568542004 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568603039 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568654060 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568701029 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568747997 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568779945 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568819046 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568839073 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568864107 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.568902969 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568947077 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.568994999 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569016933 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569058895 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569087029 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569137096 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569180012 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569220066 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569242001 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569271088 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569299936 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569340944 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569434881 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569509029 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569525003 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569566965 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569598913 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569641113 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569679976 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569735050 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569751024 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569804907 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.569844961 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.569914103 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.570452929 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.703922987 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.703967094 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.703994036 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704019070 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704041004 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704066992 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704085112 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704098940 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704123974 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704147100 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704171896 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704186916 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704212904 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704221964 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704248905 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704263926 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704288960 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704315901 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704343081 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704365969 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704377890 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704401970 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704425097 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704447031 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704464912 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704478979 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704484940 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704502106 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704518080 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704543114 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704571962 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704585075 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704611063 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704623938 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704646111 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704669952 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704694033 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704715967 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704726934 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704750061 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704757929 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704783916 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704808950 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704833031 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704849958 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704871893 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704880953 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704901934 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704926968 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704955101 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.704962969 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704982996 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.704999924 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.705025911 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.705044985 CEST	443	49743	52.1.55.52	192.168.2.7
May 12, 2021 02:26:14.705073118 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:14.705106020 CEST	49743	443	192.168.2.7	52.1.55.52
May 12, 2021 02:26:15.991614103 CEST	49680	80	192.168.2.7	93.184.220.29
May 12, 2021 02:26:16.032277107 CEST	80	49680	93.184.220.29	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 02:23:59.234335899 CEST	53129	53	192.168.2.7	8.8.8.8
May 12, 2021 02:23:59.287035942 CEST	53	53129	8.8.8.8	192.168.2.7
May 12, 2021 02:23:59.671509027 CEST	62452	53	192.168.2.7	8.8.8.8
May 12, 2021 02:23:59.728662014 CEST	53	62452	8.8.8.8	192.168.2.7
May 12, 2021 02:24:00.530673981 CEST	57820	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:00.552372932 CEST	50848	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:00.582250118 CEST	53	57820	8.8.8.8	192.168.2.7
May 12, 2021 02:24:00.609018087 CEST	53	50848	8.8.8.8	192.168.2.7
May 12, 2021 02:24:02.573972940 CEST	61242	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:02.628433943 CEST	53	61242	8.8.8.8	192.168.2.7
May 12, 2021 02:24:03.477829933 CEST	58562	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:03.526549101 CEST	53	58562	8.8.8.8	192.168.2.7
May 12, 2021 02:24:03.909331083 CEST	56590	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:03.967650890 CEST	53	56590	8.8.8.8	192.168.2.7
May 12, 2021 02:24:04.496669054 CEST	60501	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:04.549942970 CEST	53	60501	8.8.8.8	192.168.2.7
May 12, 2021 02:24:05.341583014 CEST	53775	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:05.401645899 CEST	53	53775	8.8.8.8	192.168.2.7
May 12, 2021 02:24:06.561137915 CEST	51837	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:06.620980978 CEST	53	51837	8.8.8.8	192.168.2.7
May 12, 2021 02:24:07.681329012 CEST	55411	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:07.738629103 CEST	53	55411	8.8.8.8	192.168.2.7
May 12, 2021 02:24:09.023803949 CEST	63668	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:09.072552919 CEST	53	63668	8.8.8.8	192.168.2.7
May 12, 2021 02:24:11.329884052 CEST	54640	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:11.380841017 CEST	53	54640	8.8.8.8	192.168.2.7
May 12, 2021 02:24:12.518608093 CEST	58739	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:12.581053972 CEST	53	58739	8.8.8.8	192.168.2.7
May 12, 2021 02:24:13.885335922 CEST	60338	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:13.942657948 CEST	53	60338	8.8.8.8	192.168.2.7
May 12, 2021 02:24:15.328852892 CEST	58717	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:15.377600908 CEST	53	58717	8.8.8.8	192.168.2.7
May 12, 2021 02:24:16.653407097 CEST	59762	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:16.713121891 CEST	53	59762	8.8.8.8	192.168.2.7
May 12, 2021 02:24:17.786389112 CEST	54329	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:17.835092068 CEST	53	54329	8.8.8.8	192.168.2.7
May 12, 2021 02:24:18.887445927 CEST	58052	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:18.943770885 CEST	53	58052	8.8.8.8	192.168.2.7
May 12, 2021 02:24:22.554928064 CEST	54008	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:22.605132103 CEST	53	54008	8.8.8.8	192.168.2.7
May 12, 2021 02:24:24.417440891 CEST	59451	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:24.474648952 CEST	53	59451	8.8.8.8	192.168.2.7
May 12, 2021 02:24:26.502182007 CEST	52914	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:26.553018093 CEST	53	52914	8.8.8.8	192.168.2.7
May 12, 2021 02:24:31.195421934 CEST	64569	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:31.245270967 CEST	53	64569	8.8.8.8	192.168.2.7
May 12, 2021 02:24:32.472074032 CEST	52816	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:32.520737886 CEST	53	52816	8.8.8.8	192.168.2.7
May 12, 2021 02:24:33.735950947 CEST	50781	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:33.793301105 CEST	53	50781	8.8.8.8	192.168.2.7
May 12, 2021 02:24:34.905491114 CEST	54230	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:34.954310894 CEST	53	54230	8.8.8.8	192.168.2.7
May 12, 2021 02:24:38.727338076 CEST	54911	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:38.792570114 CEST	53	54911	8.8.8.8	192.168.2.7
May 12, 2021 02:24:47.238135099 CEST	49958	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:47.297678947 CEST	53	49958	8.8.8.8	192.168.2.7
May 12, 2021 02:24:55.738006115 CEST	50860	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:55.788809061 CEST	53	50860	8.8.8.8	192.168.2.7
May 12, 2021 02:24:55.891386986 CEST	50452	53	192.168.2.7	8.8.8.8
May 12, 2021 02:24:55.950472116 CEST	53	50452	8.8.8.8	192.168.2.7
May 12, 2021 02:25:19.638885021 CEST	59730	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:19.698481083 CEST	53	59730	8.8.8.8	192.168.2.7
May 12, 2021 02:25:22.367999077 CEST	59310	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:22.429711103 CEST	53	59310	8.8.8.8	192.168.2.7
May 12, 2021 02:25:28.948553085 CEST	51919	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:28.998121977 CEST	53	51919	8.8.8.8	192.168.2.7
May 12, 2021 02:25:29.453366041 CEST	64296	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:29.513613939 CEST	53	64296	8.8.8.8	192.168.2.7
May 12, 2021 02:25:30.015614986 CEST	56680	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:30.072673082 CEST	53	56680	8.8.8.8	192.168.2.7
May 12, 2021 02:25:30.554110050 CEST	58820	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:30.605623007 CEST	53	58820	8.8.8.8	192.168.2.7
May 12, 2021 02:25:30.726777077 CEST	60983	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:30.783682108 CEST	53	60983	8.8.8.8	192.168.2.7
May 12, 2021 02:25:31.050759077 CEST	49247	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:31.110187054 CEST	53	49247	8.8.8.8	192.168.2.7
May 12, 2021 02:25:31.606375933 CEST	52286	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:31.666471958 CEST	53	52286	8.8.8.8	192.168.2.7
May 12, 2021 02:25:32.047724009 CEST	56064	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:32.106234074 CEST	53	56064	8.8.8.8	192.168.2.7
May 12, 2021 02:25:32.687417030 CEST	63744	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:32.739056110 CEST	53	63744	8.8.8.8	192.168.2.7
May 12, 2021 02:25:33.412689924 CEST	61457	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:33.461370945 CEST	53	61457	8.8.8.8	192.168.2.7
May 12, 2021 02:25:33.841306925 CEST	58367	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:33.892798901 CEST	53	58367	8.8.8.8	192.168.2.7
May 12, 2021 02:25:53.109848022 CEST	60599	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:53.166996956 CEST	53	60599	8.8.8.8	192.168.2.7
May 12, 2021 02:25:53.555330992 CEST	59571	53	192.168.2.7	8.8.8.8
May 12, 2021 02:25:53.622461081 CEST	53	59571	8.8.8.8	192.168.2.7
May 12, 2021 02:26:12.135572910 CEST	52689	53	192.168.2.7	8.8.8.8
May 12, 2021 02:26:12.192837000 CEST	53	52689	8.8.8.8	192.168.2.7
May 12, 2021 02:26:13.480292082 CEST	50290	53	192.168.2.7	8.8.8.8
May 12, 2021 02:26:13.542099953 CEST	53	50290	8.8.8.8	192.168.2.7
May 12, 2021 02:26:13.544945955 CEST	60427	53	192.168.2.7	8.8.8.8
May 12, 2021 02:26:13.605001926 CEST	53	60427	8.8.8.8	192.168.2.7
May 12, 2021 02:26:14.710372925 CEST	56209	53	192.168.2.7	8.8.8.8
May 12, 2021 02:26:14.817440987 CEST	53	56209	8.8.8.8	192.168.2.7
May 12, 2021 02:26:14.819259882 CEST	59582	53	192.168.2.7	8.8.8.8
May 12, 2021 02:26:14.907476902 CEST	53	59582	8.8.8.8	192.168.2.7
May 12, 2021 02:26:16.082575083 CEST	59583	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.082804918 CEST	59584	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.082921028 CEST	59585	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083025932 CEST	59586	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083219051 CEST	59587	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083324909 CEST	59588	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083422899 CEST	59589	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083534002 CEST	59590	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083626986 CEST	59591	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083719969 CEST	59592	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.083817959 CEST	59593	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.084034920 CEST	59594	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.084095955 CEST	59595	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.084292889 CEST	59596	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.084892035 CEST	59597	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.085131884 CEST	59598	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.085412979 CEST	59599	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.085503101 CEST	59600	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.085670948 CEST	59601	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.085844040 CEST	59602	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086025953 CEST	59603	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086225986 CEST	59604	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086394072 CEST	59605	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086566925 CEST	59606	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086735964 CEST	59607	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.086921930 CEST	59608	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087094069 CEST	59609	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087275982 CEST	59610	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087457895 CEST	59611	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087630987 CEST	59612	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087805033 CEST	59613	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.087973118 CEST	59614	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.088139057 CEST	59615	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.088330030 CEST	59616	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.088520050 CEST	59617	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.088726997 CEST	59618	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.088903904 CEST	59619	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089174986 CEST	59620	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089248896 CEST	59621	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089421034 CEST	59622	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089596033 CEST	59623	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089766026 CEST	59624	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.089937925 CEST	59625	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.090105057 CEST	59626	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.090265989 CEST	59627	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.129967928 CEST	59628	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.178601980 CEST	59629	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.178827047 CEST	59630	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179014921 CEST	59631	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179184914 CEST	59632	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179352045 CEST	59633	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179531097 CEST	59634	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179716110 CEST	59635	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.179887056 CEST	59636	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180088043 CEST	59637	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180258036 CEST	59638	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180429935 CEST	59639	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180665016 CEST	59640	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180784941 CEST	59641	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.180964947 CEST	59642	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.181147099 CEST	59643	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.181314945 CEST	59644	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.181490898 CEST	59645	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.181659937 CEST	59646	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.181819916 CEST	59647	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182009935 CEST	59648	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182200909 CEST	59649	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182370901 CEST	59650	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182535887 CEST	59651	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182717085 CEST	59652	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.182888985 CEST	59653	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183059931 CEST	59654	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183238029 CEST	59655	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183404922 CEST	59656	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183582067 CEST	59657	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183747053 CEST	59658	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.183904886 CEST	59659	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184077024 CEST	59660	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184245110 CEST	59661	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184417963 CEST	59662	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184596062 CEST	59663	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184770107 CEST	59664	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.184935093 CEST	59665	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185108900 CEST	59666	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185285091 CEST	59667	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185451984 CEST	59668	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185627937 CEST	59669	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185798883 CEST	59670	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.185961962 CEST	59671	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.186137915 CEST	59672	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.186306000 CEST	59673	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.186484098 CEST	59674	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.186664104 CEST	59675	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.186830997 CEST	59676	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187019110 CEST	59677	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187211037 CEST	59678	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187393904 CEST	59679	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187562943 CEST	59680	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187742949 CEST	59681	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.187908888 CEST	59682	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.188165903 CEST	59683	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.188348055 CEST	59684	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.188512087 CEST	59685	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.188699007 CEST	59686	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.188878059 CEST	59687	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189044952 CEST	59688	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189227104 CEST	59689	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189397097 CEST	59690	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189552069 CEST	59691	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189727068 CEST	59692	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.189894915 CEST	59693	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190071106 CEST	59694	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190244913 CEST	59695	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190413952 CEST	59696	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190587044 CEST	59697	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190757990 CEST	59698	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.190931082 CEST	59699	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.191099882 CEST	59700	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.191276073 CEST	59701	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.191446066 CEST	59702	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.191612959 CEST	59703	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.191807985 CEST	59704	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245085001 CEST	59705	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245258093 CEST	59706	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245361090 CEST	59707	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245481014 CEST	59708	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245584965 CEST	59709	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245683908 CEST	59710	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245793104 CEST	59711	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245889902 CEST	59712	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.245985985 CEST	59713	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246083975 CEST	59714	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246191025 CEST	59715	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246284962 CEST	59716	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246388912 CEST	59717	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246475935 CEST	59718	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246576071 CEST	59719	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246673107 CEST	59720	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246764898 CEST	59721	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246870995 CEST	59722	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.246965885 CEST	59723	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247057915 CEST	59724	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247162104 CEST	59725	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247257948 CEST	59726	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247350931 CEST	59727	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247448921 CEST	59728	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247550964 CEST	59729	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247644901 CEST	59730	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.247733116 CEST	59731	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.263778925 CEST	59732	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.264060020 CEST	59733	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.264271975 CEST	59734	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.264488935 CEST	59735	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.497880936 CEST	59736	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498086929 CEST	59737	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498294115 CEST	59738	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498501062 CEST	59739	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498697042 CEST	59740	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498830080 CEST	59741	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.498948097 CEST	59742	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499078989 CEST	59743	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499280930 CEST	59744	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499466896 CEST	59745	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499604940 CEST	59746	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499763966 CEST	59747	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.499969006 CEST	59748	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.500124931 CEST	59749	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.500379086 CEST	59750	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.500601053 CEST	59751	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.501075029 CEST	59752	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.501324892 CEST	59753	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.501813889 CEST	59754	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.502015114 CEST	59755	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.502183914 CEST	59756	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.502367020 CEST	59757	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.502574921 CEST	59758	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.502830029 CEST	59759	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503058910 CEST	59760	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503242016 CEST	59761	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503421068 CEST	59762	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503592968 CEST	59763	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503730059 CEST	59764	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.503926039 CEST	59765	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.504111052 CEST	59766	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.504478931 CEST	59767	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.504678011 CEST	59768	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.504847050 CEST	59769	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.504961014 CEST	59770	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505063057 CEST	59771	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505198002 CEST	59772	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505294085 CEST	59773	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505414009 CEST	59774	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505517960 CEST	59775	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505624056 CEST	59776	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505734921 CEST	59777	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.505939960 CEST	59778	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506064892 CEST	59779	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506169081 CEST	59780	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506541014 CEST	59781	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506715059 CEST	59782	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506834984 CEST	59783	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.506956100 CEST	59784	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507066011 CEST	59785	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507158995 CEST	59786	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507266998 CEST	59787	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507365942 CEST	59788	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507463932 CEST	59789	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507566929 CEST	59790	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507687092 CEST	59791	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507783890 CEST	59792	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.507884026 CEST	59793	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508121014 CEST	59795	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508128881 CEST	59794	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508229971 CEST	59796	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508343935 CEST	59797	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508445024 CEST	59798	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508538008 CEST	59799	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508644104 CEST	59800	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508735895 CEST	59801	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.508840084 CEST	59802	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509040117 CEST	59803	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509311914 CEST	59804	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509525061 CEST	59805	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509625912 CEST	59806	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509721041 CEST	59807	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509831905 CEST	59808	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.509974957 CEST	59809	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.510176897 CEST	59810	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.510354996 CEST	59811	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.510488033 CEST	59812	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.510598898 CEST	59813	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.510826111 CEST	59814	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.511109114 CEST	59815	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.511382103 CEST	59816	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.511650085 CEST	59817	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.511836052 CEST	59818	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.511938095 CEST	59819	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.512048960 CEST	59820	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.512154102 CEST	59821	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.512376070 CEST	59822	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.512897968 CEST	59823	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.513688087 CEST	59824	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.513884068 CEST	59825	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.515094995 CEST	59826	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.515418053 CEST	59827	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.516294956 CEST	59828	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.516999960 CEST	59829	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.517222881 CEST	59830	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.517414093 CEST	59831	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.517595053 CEST	59832	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.517760992 CEST	59833	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.517930031 CEST	59834	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.518102884 CEST	59835	3	192.168.2.7	192.168.2.255
May 12, 2021 02:26:16.518285990 CEST	59836	3	192.168.2.7	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
May 12, 2021 02:24:29.324944019 CEST	192.168.2.7	192.168.2.1	4d5a	Echo
May 12, 2021 02:24:29.324980021 CEST	192.168.2.1	192.168.2.7	555a	Echo Reply
May 12, 2021 02:24:35.390738010 CEST	192.168.2.7	192.168.2.255	4d4f	Echo
May 12, 2021 02:26:16.527846098 CEST	192.168.2.7	192.168.2.1	4c5c	Echo
May 12, 2021 02:26:16.527889013 CEST	192.168.2.1	192.168.2.7	545c	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 02:26:13.480292082 CEST	192.168.2.7	8.8.8.8	0xfe7c	Standard query (0)	www.poweradmin.com	A (IP address)	IN (0x0001)
May 12, 2021 02:26:13.544945955 CEST	192.168.2.7	8.8.8.8	0x44e1	Standard query (0)	www.poweradmin.com	A (IP address)	IN (0x0001)
May 12, 2021 02:26:14.710372925 CEST	192.168.2.7	8.8.8.8	0xc098	Standard query (0)	live.sysinternals.com	A (IP address)	IN (0x0001)
May 12, 2021 02:26:14.819259882 CEST	192.168.2.7	8.8.8.8	0x2775	Standard query (0)	live.sysinternals.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 02:26:13.542099953 CEST	8.8.8.8	192.168.2.7	0xfe7c	No error (0)	www.poweradmin.com	poweradmin.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 02:26:13.542099953 CEST	8.8.8.8	192.168.2.7	0xfe7c	No error (0)	poweradmin.com		52.1.55.52	A (IP address)	IN (0x0001)
May 12, 2021 02:26:13.605001926 CEST	8.8.8.8	192.168.2.7	0x44e1	No error (0)	www.poweradmin.com	poweradmin.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 02:26:13.605001926 CEST	8.8.8.8	192.168.2.7	0x44e1	No error (0)	poweradmin.com		52.1.55.52	A (IP address)	IN (0x0001)
May 12, 2021 02:26:14.817440987 CEST	8.8.8.8	192.168.2.7	0xc098	No error (0)	live.sysinternals.com	sysinternalvmss.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 02:26:14.907476902 CEST	8.8.8.8	192.168.2.7	0x2775	No error (0)	live.sysinternals.com	sysinternalvmss.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: e1f063d6_by_Libranalysis.exe PID: 5964 Parent PID: 5776

General

Start time:	02:24:08
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\e1f063d6_by_Libranalysis.exe'
Imagebase:	0x5f0000
File size:	145920 bytes
MD5 hash:	E1F063D63A75E0E0E864052B1A50AB06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: taskkill.exe PID: 6092 Parent PID: 5964

General

Start time:	02:24:15
Start date:	12/05/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'taskkill' /F /IM RaccineSettings.exe
Imagebase:	0x7ff7f5a80000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5436 Parent PID: 6092

General

Start time:	02:24:15
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 5868 Parent PID: 5964

General

Start time:	02:24:16
Start date:	12/05/2021
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	'reg' delete 'HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' /V 'Raccine Tray' /F
Imagebase:	0x7ff7ef960000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 3340 Parent PID: 5868

General

Start time:	02:24:16
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 2508 Parent PID: 5964

General

Start time:	02:24:17
Start date:	12/05/2021
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	'reg' delete HKCU\Software\Raccine /F
Imagebase:	0x7ff7ef960000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5624 Parent PID: 2508

General

Start time:	02:24:17
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5112 Parent PID: 5964

General

Start time:	02:24:18
Start date:	12/05/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	'schtasks' /DELETE /TN 'Raccine Rules Updater' /F
Imagebase:	0x7ff6fb500000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5440 Parent PID: 5112

General

Start time:	02:24:19
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 6084 Parent PID: 5964

General

Start time:	02:24:19
Start date:	12/05/2021
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	'netsh' advfirewall firewall set rule group=\'Network Discovery\' new enable=Yes
Imagebase:	0x7ff722160000
File size:	92672 bytes
MD5 hash:	98CC37BBF363A38834253E22C80A8F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: sc.exe PID: 5660 Parent PID: 5964

General

Start time:	02:24:20
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config Dnscache start= auto
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 1000 Parent PID: 6084

General

Start time:	02:24:20
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: sc.exe PID: 6092 Parent PID: 5964

General

Start time:	02:24:20
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config SSDPSRV start= auto
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5112 Parent PID: 5660

General

Start time:	02:24:20
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6232 Parent PID: 5964

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config SQLTELEMETRY start= disabled
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6240 Parent PID: 6092

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6284 Parent PID: 5964

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config SQLWriter start= disabled
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6292 Parent PID: 6232

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6324 Parent PID: 5964

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config FDResPub start= auto
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6332 Parent PID: 6284

General

Start time:	02:24:21
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6364 Parent PID: 5964

General

Start time:	02:24:22
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config upnphost start= auto
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6372 Parent PID: 6324

General

Start time:	02:24:22
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6412 Parent PID: 5964

General

Start time:	02:24:22
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config SQLTELEMETRY$ECWDB2 start= disabled
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6420 Parent PID: 6364

General

Start time:	02:24:22
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6452 Parent PID: 5964

General

Start time:	02:24:22
Start date:	12/05/2021
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	'sc.exe' config SstpSvc start= disabled
Imagebase:	0x7ff699e00000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6460 Parent PID: 6412

General

Start time:	02:24:23
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 6500 Parent PID: 5964

General

Start time:	02:24:23
Start date:	12/05/2021
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	'netsh' advfirewall firewall set rule group=\'File and Printer Sharing\' new enable=Yes
Imagebase:	0x7ff722160000
File size:	92672 bytes
MD5 hash:	98CC37BBF363A38834253E22C80A8F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6508 Parent PID: 6452

General

Start time:	02:24:23
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6560 Parent PID: 6500

General

Start time:	02:24:24
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 6732 Parent PID: 5964

General

Start time:	02:24:26
Start date:	12/05/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'taskkill.exe' /IM mspub.exe /F
Imagebase:	0x7ff65dd40000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 6744 Parent PID: 5964

General

Start time:	02:24:26
Start date:	12/05/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'taskkill.exe' /IM xfssvccon.exe /F
Imagebase:	0x7ff65dd40000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6752 Parent PID: 6732

General

Start time:	02:24:26
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 6764 Parent PID: 5964

General

Start time:	02:24:26
Start date:	12/05/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'taskkill.exe' /IM mydesktopqos.exe /F
Imagebase:	0x7ff65dd40000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6772 Parent PID: 6744

General

Start time:	02:24:27
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 6820 Parent PID: 5964

General

Start time:	02:24:27
Start date:	12/05/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	'taskkill.exe' /IM sqlbrowser.exe /F
Imagebase:	0x7ff65dd40000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6828 Parent PID: 6764

General

Start time:	02:24:27
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report e1f063d6_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage