Create Interactive Tour

Analysis Report https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2

Overview

General Information

Sample URL:	https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2
Analysis ID:	337367
Most interesting Screenshot:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Antivirus or Machine Learning detection for unpacked file

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Potential browser exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Classification

Startup

System is w10x64

iexplore.exe (PID: 5172 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5480 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5172 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

unarchiver.exe (PID: 5744 cmdline: 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip' MD5: 8B435F8731563566F3F49203BA277865)

7za.exe (PID: 1632 cmdline: 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\poyytgcb.bev' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 3840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 800 cmdline: 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

manfiltr.exe (PID: 2616 cmdline: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe MD5: AF9EEDACA97462C974D9933011DE3584)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• AV Detection
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 8.2.manfiltr.exe.400000.0.unpack	Avira: Label: TR/Dropper.VB.Gen
Source: 8.0.manfiltr.exe.400000.0.unpack	Avira: Label: TR/Dropper.VB.Gen

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 022A097Fh		3_2_022A02A8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 022A097Eh		3_2_022A02A8

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\SysWOW64\unarchiver.exe

Jump to behavior

Source: unknown

DNS traffic detected: queries for: us.klinge.biz

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 3_2_022A02A8

3_2_022A02A8

Source: classification engine

Classification label: clean4.win@13/12@1/1

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3152:120:WilError_01

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD1E092C5CA8B53EC.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: manfiltr.exe, 00000008.00000002.474259718.0000000000401000.00000020.00020000.sdmp, manfiltr.exe.4.dr

Binary or memory string: INSERT INTO SYSUSERS ( USER_NAME, PASSWORD, SAM_ONLY, [LEVEL] ) VALUES ('0123' , 'CORN' , True, 3)8DELETE * FROM USER_SECURITY;bUPDATE AUDIT_EVENTS_TTC SET WIN_USER = 'Filtered'>Command line arguments missing.*Application version: |Input TTC database filename command line argument is required.~Output TTC database filename command line argument is required.

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5172 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'
Source: unknown	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\poyytgcb.bev' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5172 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe 'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\poyytgcb.bev' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4228	Thread sleep count: 204 > 30			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 4228	Thread sleep time: -102000s >= -30000s			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: manfiltr.exe, 00000008.00000002.474259718.0000000000401000.00000020.00020000.sdmp, manfiltr.exe.4.dr

Binary or memory string: LLLLLLLLLNNNNNNMMMMMMMMMNOPQQQTUVSSSMMMOPQSSSSTUOY]TVXTUVRRRMMMKKKJJJKKKMMMOPQOVYS_eNclNclMfqOeoPfpRgpOckQemUgoUgoTelSdkN=lG2`F/]F/]F/\G0]I2`J3`G3cG4cG4cG3cG2`H2`G1_G0^G0]F/]F/]F/]G0]G0]G0]F/]F/\F/]FHmEv

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe 'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\poyytgcb.bev' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe	Jump to behavior

Source: unarchiver.exe, 00000003.00000002.475289152.0000000000DE0000.00000002.00000001.sdmp, manfiltr.exe, 00000008.00000002.475198206.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: unarchiver.exe, 00000003.00000002.475289152.0000000000DE0000.00000002.00000001.sdmp, manfiltr.exe, 00000008.00000002.475198206.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: unarchiver.exe, 00000003.00000002.475289152.0000000000DE0000.00000002.00000001.sdmp, manfiltr.exe, 00000008.00000002.475198206.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: unarchiver.exe, 00000003.00000002.475289152.0000000000DE0000.00000002.00000001.sdmp, manfiltr.exe, 00000008.00000002.475198206.0000000000D30000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution1	Path Interception	Process Injection12	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	System Information Discovery12	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2	0%	Virustotal		Browse
https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe	4%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe	2%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
8.2.manfiltr.exe.400000.0.unpack	100%	Avira	TR/Dropper.VB.Gen		Download File
8.0.manfiltr.exe.400000.0.unpack	100%	Avira	TR/Dropper.VB.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
us.klinge.biz	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
0	0%	Virustotal		Browse

Domains and IPs Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us.klinge.biz	52.202.55.99	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0	false	0%, Virustotal, Browse	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.202.55.99	unknown	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	337367
Start date:	08.01.2021
Start time:	13:56:32
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean4.win@13/12@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 11 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, ielowutil.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 104.43.139.144, 88.221.62.148, 23.210.248.85, 152.199.19.161, 205.185.216.10, 205.185.216.42 Excluded domains from analysis (whitelisted): fs.microsoft.com, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, skypedataprdcoleus17.cloudapp.net, go.microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, cs9.wpc.v0cdn.net Execution Graph export aborted for target unarchiver.exe, PID 5744 because it is empty

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7B9283D2-51FC-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	32344
Entropy (8bit):	1.7973882827359091
Encrypted:	false
SSDEEP:	48:IwKGcpr/GwpLaG/ap82trGIpcyhGvnZpvyNGoQqp9yGGo4BpmydOGWe+9yQGWo+u:ruZJZA22t9WyutyDfyhBMydoygtJrn2
MD5:	6FABD66FB2F10C75FA2D86F67DA189A7
SHA1:	41E135C63D865A3759AF34BCF2DAF9CE05C61957
SHA-256:	C2A6DB3B8CC226ECAE5FD69580A6AF367882C00F02F5EE18F81DB15401B6067B
SHA-512:	52BD434E5BF5917B069DF0C62D1A6D4278608C6117A3DC867010EBC5792EE4EF03BFF4FA804EE23B2B6E906EF399A7D6352262D04D44B5BE3B18122AD307EDFC
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7B9283D4-51FC-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.596994914264384
Encrypted:	false
SSDEEP:	48:IwSGcprDGwpaTG4pQPGrapbSRztrGQpBiGHHpcwtsTGUpQz9/WGcpm:rmZdQl6TBSRztFj52wtk6Ug
MD5:	F5297E5623A1886836E7D7364347CAE0
SHA1:	1FE6691D8FBF07D4DAC8B71FBB2DEC5848F12D9F
SHA-256:	B546BDE300EC1FA0C4ACF762413E16A7550769BD4C80A76F102036894973E220
SHA-512:	4FD08824B6095E06E69C0B17FD8BFE154C01C63FD90F7110467A6CF4CC53DA25F3CA539BEF0B1139C8662F902EFFD1983EAF76E055830ED11D5ED6B4936E584D
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip.o1mr3q3.partial Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	319796
Entropy (8bit):	7.997870894325883
Encrypted:	true
SSDEEP:	6144:wNxFDNiRl4mV5MAac4cDI6giNSVhfd4gm1BK8xPTVP0r7JwIWptFxri3EguO8:SxFhijnMAlT9pohYBK8tTF0JVq
MD5:	8B894AD8091B41D9ABF67A27CCE5D938
SHA1:	1293A6920535ECB8215F04A0A17A9478953776D3
SHA-256:	053ABE83D6FB545381E920449812B3EFCA925AFC93B097904ECB2A2803228F9B
SHA-512:	2288469ED08037F3898E4FD811DB54AF67C7D185B76BCC61F3C289D96C2594E8BDB1CE9534AAA97E660DBB325E2949FC554546C60147B5FC62D7EC7D9B1FB5A5
Malicious:	false
Reputation:	low
Preview:	PK..........BN................Manfilter_3104/PK........aV.Lg!.L.a..........Manfilter_3104/klinge.mdw...b-..E..}b.m......m...m.m?.O......0....+.........0........B...WX8...e.....f2..w^3v.N..o\..._k.}^q.f...S...F..&...=w.<.PE...XX..t.[\|...}2.q.Q...m....R..#.B-F.)D.o...!...<1.............8........V,..z%.r. ...W...$...S.'...Q..hG......}`I..WL2:r...M...mQ.I..%{M...]J=8.m..U+NS.X[.....".......u...N;...<.s.^..l.G.5.[W...DB2..8..mo.....KS..u.&#.$....~..QU......:...g`V.x)..; \|K.z.-.-..t:.c..Q..%.C....E`..C..0.:.[_..K\....@\.<..L.\..k...FI..XP......_.+.e.&.G0....5..\c[....\|.4T.A1.?....]...\|A.....<._.V.e....6.(@.g..[.AERU.......b.g.@4..S...+U...C...UC.p..'..{!...K.......&Ei..{9..........$.{).._{..(U.......3...-u..p.Q.... pu ......=S.XN....=.......-...yb......0g}.I1.]jn.qb....Pb.dm .~.1...Z....^.)>t.9..4.C.... .C....fG..A...AG\|#.I.?.3eY..]...J..X16.......>T1*.F..#<.{yr....AQ4.D.g..>...M"~$.f...95...v5.EM...s.3`#......;."{...?.eW..I....4...w.D...3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip.o1mr3q3.partial:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:W:W
MD5:	ECCBC87E4B5CE2FE28308FD9F2A7BAF3
SHA1:	77DE68DAECD823BABBB58EDB1C8E14D7106E83BB
SHA-256:	4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
SHA-512:	3BAFBF08882A2D10133093A1B8433F50563B93C14ACD05B79028EB1D12799027241450980651994501423A66C276AE26C43B739BC65C4E16B10C3AF6C202AEBB
Malicious:	false
Reputation:	low
Preview:	3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Manfilter_3104[1].zip Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	319796
Entropy (8bit):	7.997870894325883
Encrypted:	true
SSDEEP:	6144:wNxFDNiRl4mV5MAac4cDI6giNSVhfd4gm1BK8xPTVP0r7JwIWptFxri3EguO8:SxFhijnMAlT9pohYBK8tTF0JVq
MD5:	8B894AD8091B41D9ABF67A27CCE5D938
SHA1:	1293A6920535ECB8215F04A0A17A9478953776D3
SHA-256:	053ABE83D6FB545381E920449812B3EFCA925AFC93B097904ECB2A2803228F9B
SHA-512:	2288469ED08037F3898E4FD811DB54AF67C7D185B76BCC61F3C289D96C2594E8BDB1CE9534AAA97E660DBB325E2949FC554546C60147B5FC62D7EC7D9B1FB5A5
Malicious:	false
Reputation:	low
Preview:	PK..........BN................Manfilter_3104/PK........aV.Lg!.L.a..........Manfilter_3104/klinge.mdw...b-..E..}b.m......m...m.m?.O......0....+.........0........B...WX8...e.....f2..w^3v.N..o\..._k.}^q.f...S...F..&...=w.<.PE...XX..t.[\|...}2.q.Q...m....R..#.B-F.)D.o...!...<1.............8........V,..z%.r. ...W...$...S.'...Q..hG......}`I..WL2:r...M...mQ.I..%{M...]J=8.m..U+NS.X[.....".......u...N;...<.s.^..l.G.5.[W...DB2..8..mo.....KS..u.&#.$....~..QU......:...g`V.x)..; \|K.z.-.-..t:.c..Q..%.C....E`..C..0.:.[_..K\....@\.<..L.\..k...FI..XP......_.+.e.&.G0....5..\c[....\|.4T.A1.?....]...\|A.....<._.V.e....6.(@.g..[.AERU.......b.g.@4..S...+U...C...UC.p..'..{!...K.......&Ei..{9..........$.{).._{..(U.......3...-u..p.Q.... pu ......=S.XN....=.......-...yb......0g}.I1.]jn.qb....Pb.dm .~.1...Z....^.)>t.9..4.C.... .C....fG..A...AG\|#.I.?.3eY..]...J..X16.......>T1*.F..#<.{yr....AQ4.D.g..>...M"~$.f...95...v5.EM...s.3`#......;."{...?.eW..I....4...w.D...3.

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89
Entropy (8bit):	4.313894914180916
Encrypted:	false
SSDEEP:	3:oVXU3s+UdH8JOGXnE3s+US+n:o9UxeHqExs
MD5:	1C57FD428ED94D455865F6C5640850E7
SHA1:	D6CEDC24C5DB49A9195AC04D87CC1FE774AA8D9B
SHA-256:	207F57B38E3069365B76C3A15C39FB722660ED9D1B5569AC19E1FE92193CEF34
SHA-512:	D8FE9D278B0A847DAE8D5A0EC7B8FB0A204EA04B327CD8F9933C10FBBB60C8E659890574912E623854202895C5701EA6F7668AE66D7A2C5591BE23BD1EF52B5D
Malicious:	false
Reputation:	low
Preview:	[2021/01/08 13:57:23.111] Latest deploy version: ..[2021/01/08 13:57:23.111] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\mtp4esta.md5\unarchiver.log Download File
Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1717
Entropy (8bit):	5.20692432796918
Encrypted:	false
SSDEEP:	48:4EDjaPK2GA2GbA2GA2GpC2GPN2GA2GpCDja2Gbu2GRDja2G42GY12GA2GL2GA2Gs:4cj5qUe2ZV
MD5:	60ADC02DA1B6D08E45FA845A42EEDCC2
SHA1:	79FBE1431D2DBE3E739E12BF30796CF9D87D184A
SHA-256:	E2EF6589A80383B85D83907B8BA2F86C489DBBE74C528630B24FB539C3EA162D
SHA-512:	9455EE20C7F0A388A1B0FCA5370C3631E8F5CE59A621BC438CA81CB9DB24A00D236E6332C8EC18C9B1311956061822ED2A28884013688ECC4C1AD712241C5AE9
Malicious:	false
Reputation:	low
Preview:	01/08/2021 1:57 PM: Unpack: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip..01/08/2021 1:57 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\poyytgcb.bev..01/08/2021 1:57 PM: Received from standard out: ..01/08/2021 1:57 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..01/08/2021 1:57 PM: Received from standard out: ..01/08/2021 1:57 PM: Received from standard out: Scanning the drive for archives:..01/08/2021 1:57 PM: Received from standard out: 1 file, 319796 bytes (313 KiB)..01/08/2021 1:57 PM: Received from standard out: ..01/08/2021 1:57 PM: Received from standard out: Extracting archive: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip..01/08/2021 1:57 PM: Received from standard out: --..01/08/2021 1:57 PM: Received from standard out: Path = C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip..01/08/2021 1:57 PM: Rec

C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\klinge.mdw Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.178450688497555
Encrypted:	false
SSDEEP:	3072:O5mPTXo55N47Rl4yV53etjAacGcoTyurJ:PW5NGRl4yV5sAacG+WJ
MD5:	FFC9102C983930D33AF7DC5917324286
SHA1:	C88A928FAFF7820ABB3742CCA798BCF537325615
SHA-256:	A41E646A09771962B167C442FB2AE1DC41091A6A0A9D1B165E2B4E62F8ACDAA2
SHA-512:	19BEFE95F475CC9A71EE2170226B0645563C368D752A686AA31AB47FC87BAC051EDC5DAB13C073745D7D09BBC71F91F875C239DEFEBDC43E947A67490FE4583D
Malicious:	false
Reputation:	low
Preview:	....Jet System DB ......n.b`..U.gr@?..~.....1....0...b...F..X...7]D...^(....`T.{6Vx.w..C..34ay[..\|*..\|......OJ.l>`&_...$.g..'D...e....F.x....-..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe Download File
Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	733184
Entropy (8bit):	5.93295584987334
Encrypted:	false
SSDEEP:	6144:EHOjpHvff12IKY8u2OQV3nU+nKtS2Nv4zPHOjpHvfaEoREBGOHpcNh2RL7hknA9V:oOH2Ma2UOYEIOHpcDqLf9fXFWSn17
MD5:	AF9EEDACA97462C974D9933011DE3584
SHA1:	22FDC9D667D32C00A5DC989E911962378147009B
SHA-256:	9694DCC0BE8F9C5979F893D074F9E56E2AE41DDD5AFF91025A63D7E862FCE724
SHA-512:	F0AE7039AFD56EFEA8CE42FE3D74961B87FBC7ACE1D7BBCC57595458C7B3C7A4C320836A0FE8291D420A8B4C3A5AD0EE7EC2105B1C08AD5C562BC03BB5E9DAFA
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 4%, Browse Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............i...i...i...d...i.Rich..i.................PE..L.....pU.....................@......L........ ....@..........................`......jJ..........................................(....P...................................................................... ... ....................................text............................... ..`.data...$.... ......................@....rsrc........P....... ..............@..@...H............MSVBVM60.DLL............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD1E092C5CA8B53EC.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12981
Entropy (8bit):	0.44420853702577207
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loJF9loL9lWSZz/7n:kBqoIsySp/7n
MD5:	FD3B5518C77DF332F12668A6FC2E7CB0
SHA1:	2D09FDD686A08601B9C8806D5E74BF14289AD5AE
SHA-256:	4B4635342B54702CAA5B4D31FFD3E6BEB3D5AAF9E8AECA71F3FCE1C4A5EF42A5
SHA-512:	F40980DB335E62F806BF127B8E2723EC57FD828AC6466AA843F6623352F5F35ABD8BE32B365D607FF8D627D2FEBF23F5914A1176DF6BB619B482926D824EC879
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE1328C7B448C3F3B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	29989
Entropy (8bit):	0.3298275912603426
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lw829lwJ9l2f/9l2H9lx:kBqoxKAuvScS+85sf+azy
MD5:	72D0AA8B7A6AA44D165605D6F2C9F793
SHA1:	46EA6C8D6B7E16B05EC11329EDB2868E2F79C655
SHA-256:	4DD878CAD7D73EDBA0778946F10428093A8E7019493443B73B19DE43DA9EEB06
SHA-512:	8FAA360A58D1318213614D7500C7634F1CD1BCC250747005D5DFB744830D3D8CE9EC08FD3A6DBD2B50CEC3C767256F011DE1216E03B68656C210DE1C46F46FC9
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 274
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2021 13:57:24.021728992 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.022275925 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.147872925 CET	443	49695	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.148041964 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.148219109 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.148319960 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.160247087 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.160525084 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.292232990 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292280912 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292321920 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292388916 CET	443	49695	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292426109 CET	443	49695	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292471886 CET	443	49695	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.292475939 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.292615891 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.341391087 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.341607094 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.347116947 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.468736887 CET	443	49695	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.468780994 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.468858004 CET	49695	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.468931913 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.476843119 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.476897001 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.476933956 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.476972103 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.476979017 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.477010965 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.477049112 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.477056026 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.477144957 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.595626116 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.595693111 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603099108 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603142023 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603179932 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603179932 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603195906 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603219032 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603230953 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603256941 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603275061 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603303909 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603308916 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603359938 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603370905 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603396893 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603408098 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603435040 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603446960 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603472948 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603485107 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603509903 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603523016 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603548050 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.603559971 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.603600025 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.722402096 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.722457886 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.722603083 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729502916 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729553938 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729568958 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729604959 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729605913 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729650974 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729660034 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729707003 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729711056 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729756117 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729758978 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729804993 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729813099 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729859114 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729861021 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729907036 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729923010 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.729970932 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.729976892 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730024099 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730027914 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730073929 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730079889 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730124950 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730130911 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730178118 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730179071 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730223894 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730232954 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730278969 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730283022 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730329037 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730344057 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730389118 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730396032 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730442047 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730446100 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730489016 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730495930 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730546951 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730546951 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730592966 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730597019 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730638981 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730649948 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730695963 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.730698109 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.730745077 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.848712921 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.848764896 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.848793983 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.848823071 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.848877907 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.848942041 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.856722116 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.856807947 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.856808901 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.856858969 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.856878996 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.856918097 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.856924057 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.856962919 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.856962919 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857007980 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857011080 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857053041 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857089996 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857126951 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857162952 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857167959 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857193947 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857198000 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857198954 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857203960 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857208014 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857234955 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857271910 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857290030 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857297897 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857317924 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857321024 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857362032 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857367039 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857412100 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857434034 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857474089 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857486963 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857511997 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857522011 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857548952 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857563019 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857584953 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857599020 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857621908 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857635021 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857659101 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857672930 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857705116 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857707024 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857745886 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857755899 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857781887 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857795954 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857820988 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857834101 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857857943 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857871056 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857892990 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857906103 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857929945 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857944012 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.857966900 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.857981920 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858015060 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858016968 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858057022 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858063936 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858093023 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858105898 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858129978 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858141899 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858166933 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858181953 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858201981 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858220100 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858238935 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858248949 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858273983 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858299017 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858320951 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858335018 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858372927 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858416080 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858458042 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858472109 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858505964 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858505964 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858547926 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858555079 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858583927 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858603954 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858628988 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858642101 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858665943 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858680010 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858700991 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858717918 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858738899 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.858746052 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.858792067 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.974989891 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.975024939 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.975075960 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.975092888 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985479116 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985533953 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985574961 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985588074 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985621929 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985641003 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985651970 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985693932 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985706091 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985748053 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985757113 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985801935 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985806942 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985896111 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.985914946 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985966921 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.985980034 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986020088 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986042976 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986068964 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986083984 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986107111 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986134052 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986148119 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986167908 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986181974 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986202002 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986217022 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986237049 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986251116 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986279011 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986284018 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986298084 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986316919 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986339092 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986360073 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986373901 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986397028 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986416101 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986447096 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986463070 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986500978 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986519098 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986550093 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986572027 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986602068 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986624002 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986654997 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986694098 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986706972 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986706972 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986767054 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986790895 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986821890 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986840010 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986874104 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986886024 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986924887 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986936092 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.986977100 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.986990929 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987030029 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987042904 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987080097 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987087011 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987122059 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987158060 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987179041 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987190008 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987222910 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987231970 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987257004 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987277985 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987291098 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987313032 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987324953 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987358093 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987358093 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987377882 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987391949 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987416029 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987426043 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987445116 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987468004 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987485886 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987504959 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987526894 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987538099 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987554073 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987571955 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987595081 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987606049 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987623930 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987637997 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987658978 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987672091 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987687111 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987696886 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987728119 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987760067 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987771988 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987806082 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987823963 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987838984 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987860918 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987871885 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987889051 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987905025 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987926960 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987937927 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987956047 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.987972021 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.987997055 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988027096 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988030910 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988071918 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988089085 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988106966 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988122940 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988143921 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988161087 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988179922 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988197088 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988215923 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988234043 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988253117 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988270998 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988291025 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988306046 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988337040 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988343954 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988378048 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988392115 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988414049 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988434076 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988451004 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988467932 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988487959 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988504887 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988523960 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988543987 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988559961 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988575935 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988596916 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988615990 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988642931 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988648891 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988683939 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988702059 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988719940 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988744974 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988755941 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988776922 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988794088 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988810062 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988828897 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988847017 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988866091 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988884926 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988903999 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988950014 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.988950968 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988984108 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.988991976 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989006996 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989027977 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989043951 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989065886 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989084005 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989103079 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989124060 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989137888 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989157915 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989176035 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989193916 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989212036 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989229918 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989258051 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989263058 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989300013 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989322901 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989336014 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989366055 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989373922 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989406109 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989424944 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989440918 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989478111 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989495993 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989512920 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989531994 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989550114 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989578009 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989593029 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989620924 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989639997 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989654064 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989681005 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989694118 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989716053 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989742041 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989753962 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989778042 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989790916 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:24.989800930 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:24.989850998 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.105494976 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.105547905 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.105590105 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.105595112 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.105629921 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.105648041 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.115856886 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.115910053 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.115926027 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.115947008 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.115994930 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116003036 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116012096 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116038084 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116043091 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116074085 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116097927 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116112947 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116117954 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116149902 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116158962 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116189003 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116204977 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116226912 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116240978 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116262913 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116280079 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116309881 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116312027 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116350889 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116364956 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116388083 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116400957 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116425991 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116441965 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116462946 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116476059 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116499901 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116514921 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116538048 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116552114 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116574049 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116588116 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116621971 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116626978 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116663933 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116672039 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116700888 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116715908 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116740942 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116754055 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116776943 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116791010 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116812944 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116822004 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116851091 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116864920 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116887093 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116899967 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116935015 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116938114 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.116976976 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.116992950 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117014885 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117028952 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117053032 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117065907 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117089033 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117101908 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117125034 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117141962 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117162943 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117188931 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117198944 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117206097 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117245913 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117255926 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117285967 CET	443	49694	52.202.55.99	192.168.2.3
Jan 8, 2021 13:57:25.117300987 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:25.117335081 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:37.406632900 CET	49694	443	192.168.2.3	52.202.55.99
Jan 8, 2021 13:57:37.409297943 CET	49695	443	192.168.2.3	52.202.55.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2021 13:57:17.961195946 CET	49873	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:18.009367943 CET	53	49873	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:18.818311930 CET	53196	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:18.866297960 CET	53	53196	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:19.679153919 CET	56777	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:19.729990005 CET	53	56777	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:20.898179054 CET	58643	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:20.949225903 CET	53	58643	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:21.900305033 CET	60985	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:21.956677914 CET	53	60985	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:22.680814981 CET	50200	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:22.744077921 CET	53	50200	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:23.055399895 CET	51281	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:23.106204987 CET	53	51281	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:23.829370022 CET	49199	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:23.993784904 CET	53	49199	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:24.067456007 CET	50620	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:24.115411997 CET	53	50620	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:25.105437040 CET	64938	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:25.153460026 CET	53	64938	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:27.168555975 CET	60152	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:27.216695070 CET	53	60152	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:28.361356974 CET	57544	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:28.409178972 CET	53	57544	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:29.307199955 CET	55984	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:29.357979059 CET	53	55984	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:30.264095068 CET	64185	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:30.312165022 CET	53	64185	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:31.053258896 CET	65110	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:31.101202011 CET	53	65110	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:31.853590965 CET	58361	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:31.901606083 CET	53	58361	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:49.348191023 CET	63492	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:49.409419060 CET	53	63492	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:52.687067986 CET	60831	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:52.738132954 CET	53	60831	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:53.683758020 CET	60831	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:53.734771013 CET	53	60831	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:54.682180882 CET	60831	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:54.733089924 CET	53	60831	8.8.8.8	192.168.2.3
Jan 8, 2021 13:57:56.682621002 CET	60831	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:57:56.733491898 CET	53	60831	8.8.8.8	192.168.2.3
Jan 8, 2021 13:58:00.698340893 CET	60831	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:58:00.749102116 CET	53	60831	8.8.8.8	192.168.2.3
Jan 8, 2021 13:58:07.446932077 CET	60100	53	192.168.2.3	8.8.8.8
Jan 8, 2021 13:58:07.497704029 CET	53	60100	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 8, 2021 13:57:23.829370022 CET	192.168.2.3	8.8.8.8	0xb68	Standard query (0)	us.klinge.biz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 8, 2021 13:57:23.993784904 CET	8.8.8.8	192.168.2.3	0xb68	No error (0)	us.klinge.biz		52.202.55.99	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

• iexplore.exe
• iexplore.exe
• unarchiver.exe
• 7za.exe
• conhost.exe
• cmd.exe
• conhost.exe
• manfiltr.exe

Click to jump to process

Memory Usage

• iexplore.exe
• iexplore.exe
• unarchiver.exe
• 7za.exe
• conhost.exe
• cmd.exe
• conhost.exe
• manfiltr.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• iexplore.exe
• iexplore.exe
• unarchiver.exe
• 7za.exe
• conhost.exe
• cmd.exe
• conhost.exe
• manfiltr.exe

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5172 Parent PID: 792

Function Logs

General

Start time:	13:57:21
Start date:	08/01/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7109c0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Start time:	13:57:22
Start date:	08/01/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5172 CREDAT:17410 /prefetch:2
Imagebase:	0x3a0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Start time:	13:57:37
Start date:	08/01/2021
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\SysWOW64\unarchiver.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'
Imagebase:	0xf0000
File size:	10240 bytes
MD5 hash:	8B435F8731563566F3F49203BA277865
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Start time:	13:57:39
Start date:	08/01/2021
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\7za.exe' x -pinfected -y -o'C:\Users\user\AppData\Local\Temp\poyytgcb.bev' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Manfilter_3104.zip'
Imagebase:	0xf60000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Start time:	13:57:40
Start date:	08/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'cmd.exe' /C 'C:\Users\user\AppData\Local\Temp\poyytgcb.bev\Manfilter_3104\manfiltr.exe'
Imagebase:	0x380000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	1

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://us.klinge.biz/SimpleFileDownload/Home/File?file=f5dedb19-5b3a-4729-bbde-d6dff15ca3b2

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5172 Parent PID: 792

General

File Activities

File Opened

File Created

File Written

File Read

File Attributes Queried

Directory Queried

Other File Operations