Edit tour

Windows Analysis Report
chelentano.exe

Overview

General Information

Sample name:	chelentano.exe
Analysis ID:	1556973
MD5:	21506ae1a222c3862c04d187b07ed714
SHA1:	c70d79f32b962bf2e7e7901034aaedd8f2e71e35
SHA256:	267e274b75ba1c49847eb93d95be90b6382768926e9c3674d115c21c3cc6f2c4
Tags:	exeuser-aachum
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

chelentano.exe (PID: 7588 cmdline: "C:\Users\user\Desktop\chelentano.exe" MD5: 21506AE1A222C3862C04D187B07ED714)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: chelentano.exe PID: 7588	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: chelentano.exe PID: 7588	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: chelentano.exe PID: 7588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.chelentano.exe.140000000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.chelentano.exe.140000000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T22:03:04.996790+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T22:03:04.996790+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:05.003123+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-16T22:03:04.996790+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:05.003123+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	45.130.145.152	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.chelentano.exe.140000000.0.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "45.130.145.152", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "build_name": "Work", "links": "", "port": 15666}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140071EA0 CryptUnprotectData,LocalFree,	0_2_0000000140071EA0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400D2090 CryptUnprotectData,	0_2_00000001400D2090
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400721C0 CryptProtectData,LocalFree,	0_2_00000001400721C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140035EE0 CryptUnprotectData,LocalFree,	0_2_0000000140035EE0

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\chelentano.exe

Unpacked PE file: 0.2.chelentano.exe.140000000.0.unpack

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: chelentano.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400B9810 FindClose,FindFirstFileExW,GetLastError,	0_2_00000001400B9810
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400B98C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00000001400B98C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72D02C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73F72D02C

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400813B0 GetLogicalDriveStringsW,

0_2_00000001400813B0

Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 45.130.145.152:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 45.130.145.152:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.130.145.152 45.130.145.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASBAXETNRU ASBAXETNRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 45.130.145.152:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152
Source: unknown	TCP traffic detected without corresponding DNS query: 45.130.145.152

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_000000014007F200 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

0_2_000000014007F200

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: chelentano.exe, 00000000.00000003.1765988193.000001A6BEBF0000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1700062906.000001A6BEBE1000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766214084.000001A6BEBF5000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766062591.000001A6BEBF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: chelentano.exe, 00000000.00000003.1765988193.000001A6BEBF0000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1700062906.000001A6BEBE1000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766214084.000001A6BEBF5000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766062591.000001A6BEBF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/D
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/dP=z
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orges
Source: chelentano.exe, 00000000.00000003.1714091742.000001A6BEBD7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chelentano.exe, 00000000.00000003.1714091742.000001A6BEBD7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chelentano.exe, 00000000.00000002.1767292716.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mic
Source: chelentano.exe, 00000000.00000003.1708245175.000001A6BF640000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF950000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED78000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDEF000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA6A000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF958000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA11000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1710222554.000001A6BF9AD000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED70000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA19000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDF7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: chelentano.exe, 00000000.00000003.1702530023.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702442637.000001A6BF998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF94E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1701875456.000001A6BF974000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702184525.000001A6BF8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: chelentano.exe, 00000000.00000003.1702530023.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702442637.000001A6BF998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF94E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1701875456.000001A6BF974000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702184525.000001A6BF8EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chelentano.exe, 00000000.00000003.1708245175.000001A6BF640000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF950000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED78000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDEF000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA6A000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF958000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA11000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1710222554.000001A6BF9AD000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED70000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA19000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDF7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: chelentano.exe, 00000000.00000003.1708829023.000001A6BFAFF000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDFE000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA21000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA7A000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: chelentano.exe, 00000000.00000003.1708829023.000001A6BFAFF000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDFE000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA21000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA7A000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_000000014007FB30 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_000000014007FB30

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400843F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_00000001400843F0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400D26E0 NtAllocateVirtualMemory,	0_2_00000001400D26E0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140083CF0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_0000000140083CF0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D4AC0 NtMakeTemporaryObject,	0_2_00007FF73F6D4AC0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D358C NtQuerySystemInformation,NtQuerySystemInformation,GetUserNameA,GetModuleFileNameA,GetDiskFreeSpaceExA,SleepEx,GetSystemInfo,GlobalMemoryStatusEx,_invalid_parameter_noinfo_noreturn,	0_2_00007FF73F6D358C

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140081FF0	0_2_0000000140081FF0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400A114C	0_2_00000001400A114C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014007F200	0_2_000000014007F200
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140081660	0_2_0000000140081660
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014003B820	0_2_000000014003B820
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400B98C0	0_2_00000001400B98C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014003C8C0	0_2_000000014003C8C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400BE968	0_2_00000001400BE968
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014007FB30	0_2_000000014007FB30
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014003ACC0	0_2_000000014003ACC0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140095044	0_2_0000000140095044
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140097060	0_2_0000000140097060
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140039090	0_2_0000000140039090
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014004E130	0_2_000000014004E130
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140036130	0_2_0000000140036130
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140006180	0_2_0000000140006180
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014002F1C0	0_2_000000014002F1C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400751E0	0_2_00000001400751E0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400701F0	0_2_00000001400701F0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014003A1F0	0_2_000000014003A1F0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140078230	0_2_0000000140078230
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140088240	0_2_0000000140088240
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006D2A0	0_2_000000014006D2A0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400BE2CC	0_2_00000001400BE2CC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400422D0	0_2_00000001400422D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400302E0	0_2_00000001400302E0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006C300	0_2_000000014006C300
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014004E320	0_2_000000014004E320
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140061340	0_2_0000000140061340
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400283D0	0_2_00000001400283D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400A13C8	0_2_00000001400A13C8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400843F0	0_2_00000001400843F0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140080500	0_2_0000000140080500
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140026510	0_2_0000000140026510
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140025520	0_2_0000000140025520
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400555B0	0_2_00000001400555B0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006C600	0_2_000000014006C600
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400945F8	0_2_00000001400945F8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140006610	0_2_0000000140006610
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400566A0	0_2_00000001400566A0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400706A6	0_2_00000001400706A6
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400486D0	0_2_00000001400486D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140064710	0_2_0000000140064710
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140084740	0_2_0000000140084740
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140076760	0_2_0000000140076760
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400947FC	0_2_00000001400947FC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014009F7F4	0_2_000000014009F7F4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140080820	0_2_0000000140080820
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014004C820	0_2_000000014004C820
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014002F8B0	0_2_000000014002F8B0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400728C0	0_2_00000001400728C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400958D0	0_2_00000001400958D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006C930	0_2_000000014006C930
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140068950	0_2_0000000140068950
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400A19B8	0_2_00000001400A19B8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140094A00	0_2_0000000140094A00
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400A29F4	0_2_00000001400A29F4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140059A10	0_2_0000000140059A10
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140088B70	0_2_0000000140088B70
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140037B8D	0_2_0000000140037B8D
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140098C34	0_2_0000000140098C34
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006CC50	0_2_000000014006CC50
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140006D20	0_2_0000000140006D20
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006FDB0	0_2_000000014006FDB0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140005DB0	0_2_0000000140005DB0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014007AE50	0_2_000000014007AE50
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400A9EA0	0_2_00000001400A9EA0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014002FEE0	0_2_000000014002FEE0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140078F60	0_2_0000000140078F60
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014003CF60	0_2_000000014003CF60
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006CF70	0_2_000000014006CF70
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E1F90	0_2_00007FF73F6E1F90
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71FFBC	0_2_00007FF73F71FFBC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E3810	0_2_00007FF73F6E3810
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E9700	0_2_00007FF73F6E9700
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D358C	0_2_00007FF73F6D358C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D4554	0_2_00007FF73F6D4554
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D8070	0_2_00007FF73F6D8070
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5066	0_2_00007FF73F6F5066
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F718108	0_2_00007FF73F718108
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F729028	0_2_00007FF73F729028
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72D02C	0_2_00007FF73F72D02C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F50F7	0_2_00007FF73F6F50F7
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F727048	0_2_00007FF73F727048
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6EE0D0	0_2_00007FF73F6EE0D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4F7E	0_2_00007FF73F6F4F7E
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F703F70	0_2_00007FF73F703F70
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FDF40	0_2_00007FF73F6FDF40
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F718FF0	0_2_00007FF73F718FF0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4FEB	0_2_00007FF73F6F4FEB
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F737F60	0_2_00007FF73F737F60
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F736F70	0_2_00007FF73F736F70
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F3E56	0_2_00007FF73F6F3E56
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F1E4F	0_2_00007FF73F6F1E4F
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71AEE0	0_2_00007FF73F71AEE0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F717EFC	0_2_00007FF73F717EFC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D3F08	0_2_00007FF73F6D3F08
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F721E40	0_2_00007FF73F721E40
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4ECD	0_2_00007FF73F6F4ECD
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4E98	0_2_00007FF73F6F4E98
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4D91	0_2_00007FF73F6F4D91
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FCD70	0_2_00007FF73F6FCD70
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F3D65	0_2_00007FF73F6F3D65
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E0DF0	0_2_00007FF73F6E0DF0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4DE3	0_2_00007FF73F6F4DE3
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72FCA0	0_2_00007FF73F72FCA0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4C80	0_2_00007FF73F6F4C80
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F717CF8	0_2_00007FF73F717CF8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FAD00	0_2_00007FF73F6FAD00
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4CE9	0_2_00007FF73F6F4CE9
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5CD8	0_2_00007FF73F6F5CD8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F735C60	0_2_00007FF73F735C60
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4CB8	0_2_00007FF73F6F4CB8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4B94	0_2_00007FF73F6F4B94
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6DFB90	0_2_00007FF73F6DFB90
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FFB80	0_2_00007FF73F6FFB80
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F722BEC	0_2_00007FF73F722BEC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4BED	0_2_00007FF73F6F4BED
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F727B5C	0_2_00007FF73F727B5C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5A74	0_2_00007FF73F6F5A74
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71AADC	0_2_00007FF73F71AADC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F717AEC	0_2_00007FF73F717AEC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4B13	0_2_00007FF73F6F4B13
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4B04	0_2_00007FF73F6F4B04
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4AD4	0_2_00007FF73F6F4AD4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F9AC0	0_2_00007FF73F6F9AC0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6EB990	0_2_00007FF73F6EB990
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F6975	0_2_00007FF73F6F6975
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5949	0_2_00007FF73F6F5949
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F723A04	0_2_00007FF73F723A04
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F59A1	0_2_00007FF73F6F59A1
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6EA880	0_2_00007FF73F6EA880
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F7178E8	0_2_00007FF73F7178E8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F703834	0_2_00007FF73F703834
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F9910	0_2_00007FF73F6F9910
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F590A	0_2_00007FF73F6F590A
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F58A3	0_2_00007FF73F6F58A3
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72E888	0_2_00007FF73F72E888
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F0780	0_2_00007FF73F6F0780
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D2770	0_2_00007FF73F6D2770
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F8770	0_2_00007FF73F6F8770
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F574A	0_2_00007FF73F6F574A
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5720	0_2_00007FF73F6F5720
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F57F4	0_2_00007FF73F6F57F4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F57B4	0_2_00007FF73F6F57B4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71A6A4	0_2_00007FF73F71A6A4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F168A	0_2_00007FF73F6F168A
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F563F	0_2_00007FF73F6F563F
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71970C	0_2_00007FF73F71970C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F734640	0_2_00007FF73F734640
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F56D9	0_2_00007FF73F6F56D9
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F36C7	0_2_00007FF73F6F36C7
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E8590	0_2_00007FF73F6E8590
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5545	0_2_00007FF73F6F5545
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FF540	0_2_00007FF73F6FF540
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4607	0_2_00007FF73F6F4607
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F55C3	0_2_00007FF73F6F55C3
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5477	0_2_00007FF73F6F5477
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6FA470	0_2_00007FF73F6FA470
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F7204CC	0_2_00007FF73F7204CC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F7274DC	0_2_00007FF73F7274DC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F544D	0_2_00007FF73F6F544D
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F731448	0_2_00007FF73F731448
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E64D0	0_2_00007FF73F6E64D0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6E34B0	0_2_00007FF73F6E34B0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71B3A4	0_2_00007FF73F71B3A4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F532E	0_2_00007FF73F6F532E
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71D36C	0_2_00007FF73F71D36C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F33BC	0_2_00007FF73F6F33BC
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F719388	0_2_00007FF73F719388
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F702280	0_2_00007FF73F702280
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F4234	0_2_00007FF73F6F4234
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71830C	0_2_00007FF73F71830C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F52B8	0_2_00007FF73F6F52B8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6ED150	0_2_00007FF73F6ED150
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72B200	0_2_00007FF73F72B200
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F511A	0_2_00007FF73F6F511A
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F701210	0_2_00007FF73F701210
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F51F5	0_2_00007FF73F6F51F5
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F71E170	0_2_00007FF73F71E170
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6F5197	0_2_00007FF73F6F5197

Source: C:\Users\user\Desktop\chelentano.exe	Code function: String function: 000000014002B930 appears 32 times
Source: C:\Users\user\Desktop\chelentano.exe	Code function: String function: 0000000140045330 appears 58 times
Source: C:\Users\user\Desktop\chelentano.exe	Code function: String function: 0000000140034C00 appears 41 times

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_0000000140085970 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		0_2_0000000140085970
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400D2008 AdjustTokenPrivileges,CredEnumerateA,		0_2_00000001400D2008

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00007FF73F6D358C NtQuerySystemInformation,NtQuerySystemInformation,GetUserNameA,GetModuleFileNameA,GetDiskFreeSpaceExA,SleepEx,GetSystemInfo,GlobalMemoryStatusEx,_invalid_parameter_noinfo_noreturn,

0_2_00007FF73F6D358C

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_000000014003C8C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000000014003C8C0

Source: C:\Users\user\Desktop\chelentano.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963B1E203F8

Source: chelentano.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\chelentano.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chelentano.exe, 00000000.00000003.1703212922.000001A6BF8FE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: chelentano.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: chelentano.exe

Static file information: File size 2314240 > 1048576

Source: chelentano.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1c2400

Source: chelentano.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: chelentano.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\chelentano.exe

Unpacked PE file: 0.2.chelentano.exe.140000000.0.unpack

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_000000014003B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000000014003B820

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014006F341 push rbp; iretd		0_2_000000014006F342
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F6D4AC0 push qword ptr [00007FF73F8FE004h]; ret		0_2_00007FF73F6D4B2F

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_0000000140076480 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_0000000140076480

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00007FF73F6D49D6 rdtsc

0_2_00007FF73F6D49D6

Source: C:\Users\user\Desktop\chelentano.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99363

Source: C:\Users\user\Desktop\chelentano.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-99855

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400B9810 FindClose,FindFirstFileExW,GetLastError,	0_2_00000001400B9810
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400B98C0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00000001400B98C0
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F72D02C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF73F72D02C

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400813B0 GetLogicalDriveStringsW,

0_2_00000001400813B0

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_0000000140097348 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_0000000140097348

Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0`
Source: chelentano.exe, 00000000.00000003.1700856129.000001A6BCD32000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000002.1767201437.000001A6BCD1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chelentano.exe, 00000000.00000003.1700856129.000001A6BCD32000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000002.1767201437.000001A6BCD1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHq

Source: C:\Users\user\Desktop\chelentano.exe	API call chain: ExitProcess graph end node			graph_0-99807
Source: C:\Users\user\Desktop\chelentano.exe	API call chain: ExitProcess graph end node			graph_0-99803

Source: C:\Users\user\Desktop\chelentano.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00007FF73F6D49D6 rdtsc

0_2_00007FF73F6D49D6

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400843F0 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00000001400843F0

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400D22C8 IsDebuggerPresent,

0_2_00000001400D22C8

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400BBB14 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000001400BBB14

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_000000014003B820 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_000000014003B820

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00007FF73F72E23C GetProcessHeap,

0_2_00007FF73F72E23C

Source: C:\Users\user\Desktop\chelentano.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00000001400D22D8 SetUnhandledExceptionFilter,	0_2_00000001400D22D8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_000000014008F920 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000000014008F920
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F70FC48 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF73F70FC48
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F70FA60 SetUnhandledExceptionFilter,	0_2_00007FF73F70FA60
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F70F880 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73F70F880
Source: C:\Users\user\Desktop\chelentano.exe	Code function: 0_2_00007FF73F7161D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF73F7161D8

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400751E0 ShellExecuteW,

0_2_00000001400751E0

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00007FF73F729920 cpuid

0_2_00007FF73F729920

Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,	0_2_000000014009C1A8
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_00000001400A7270
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_00000001400A7340
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,	0_2_00000001400D2398
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00000001400B9480
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00000001400A7778
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00000001400A795C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_000000014009BC68
Source: C:\Users\user\Desktop\chelentano.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00000001400A6F14
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73F726090
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF73F730C78
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,	0_2_00007FF73F730B44
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF73F730A94
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,	0_2_00007FF73F73093C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF73F7306F4
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73F73065C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: EnumSystemLocalesW,	0_2_00007FF73F73058C
Source: C:\Users\user\Desktop\chelentano.exe	Code function: GetLocaleInfoW,	0_2_00007FF73F726490
Source: C:\Users\user\Desktop\chelentano.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF73F730230

Source: C:\Users\user\Desktop\chelentano.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_0000000140096718 GetSystemTimeAsFileTime,

0_2_0000000140096718

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_0000000140080110 GetUserNameW,

0_2_0000000140080110

Source: C:\Users\user\Desktop\chelentano.exe

Code function: 0_2_00000001400A114C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00000001400A114C

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: chelentano.exe PID: 7588, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.chelentano.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chelentano.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chelentano.exe PID: 7588, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\wallets
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\chelentano.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\chelentano.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\chelentano.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: chelentano.exe PID: 7588, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: chelentano.exe PID: 7588, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.chelentano.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chelentano.exe.140000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chelentano.exe PID: 7588, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	36 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://support.mic	0%	Avira URL Cloud	safe
https://api.ipify.orges	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.hotosh	chelentano.exe, 00000000.00000003.1765988193.000001A6BEBF0000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1700062906.000001A6BEBE1000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766214084.000001A6BEBF5000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766062591.000001A6BEBF4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	chelentano.exe, 00000000.00000003.1714091742.000001A6BEBD7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.a.0/sTy	chelentano.exe, 00000000.00000003.1765988193.000001A6BEBF0000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1700062906.000001A6BEBE1000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766214084.000001A6BEBF5000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1766062591.000001A6BEBF4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/D	chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.orges	chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	chelentano.exe, 00000000.00000003.1714091742.000001A6BEBD7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	chelentano.exe, 00000000.00000003.1702530023.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702442637.000001A6BF998000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	chelentano.exe, 00000000.00000003.1702530023.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702442637.000001A6BF998000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mic	chelentano.exe, 00000000.00000002.1767292716.000001A6BCD4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	chelentano.exe, 00000000.00000003.1706601756.000001A6BED7F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	chelentano.exe, 00000000.00000003.1701875456.000001A6BF94E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1701875456.000001A6BF974000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702184525.000001A6BF8EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/dP=z	chelentano.exe, 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	chelentano.exe, 00000000.00000003.1708245175.000001A6BF640000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF950000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED78000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDEF000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA6A000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709743082.000001A6BF958000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA11000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1710222554.000001A6BF9AD000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BED70000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709593125.000001A6BFA19000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1706601756.000001A6BEDF7000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1709405167.000001A6BFA72000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	chelentano.exe, 00000000.00000003.1701875456.000001A6BF94E000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1701875456.000001A6BF974000.00000004.00000020.00020000.00000000.sdmp, chelentano.exe, 00000000.00000003.1702184525.000001A6BF8EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chelentano.exe, 00000000.00000003.1701875456.000001A6BF93C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	chelentano.exe, 00000000.00000003.1712870971.000001A6BEBD3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.130.145.152	unknown	Russian Federation		49392	ASBAXETNRU	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556973
Start date and time:	2024-11-16 22:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	chelentano.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 63 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: chelentano.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.130.145.152	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Xa04iTOvv5.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	Iamgold-PYMPATA Policy_Enrollment2024739441.rtf	Get hash	malicious	Unknown	Browse	104.26.12.205
	https://brand.page/N0www1904	Get hash	malicious	Unknown	Browse	104.26.13.205
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASBAXETNRU	m2.exe	Get hash	malicious	Xmrig	Browse	194.87.31.45
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6Ev0Nd7z2t.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	6HWYiong4s.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
	btoRtc7o3v.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	45.130.145.152
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://bit.ly/3UPULW4?LmB=chMAG137nz	Get hash	malicious	Unknown	Browse	104.22.1.232
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	104.26.9.44
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	104.26.9.44
	XzCRLowRXn.exe	Get hash	malicious	Unknown	Browse	104.16.123.96
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	172.67.69.226

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Stake-Bot.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	v.dll	Get hash	malicious	Dridex Dropper	Browse	172.67.74.152
	gusetup.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Dzsb.Qyd.Install.exe	Get hash	malicious	XRed	Browse	172.67.74.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	HZ1BUCfTne.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	9RM52QaURq.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	bv2DbIiZeK.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	brozer.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	YU7jHNMJjG.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.3799693372463935
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	chelentano.exe
File size:	2'314'240 bytes
MD5:	21506ae1a222c3862c04d187b07ed714
SHA1:	c70d79f32b962bf2e7e7901034aaedd8f2e71e35
SHA256:	267e274b75ba1c49847eb93d95be90b6382768926e9c3674d115c21c3cc6f2c4
SHA512:	351b4739f56820e271887d953ce1fdf68e19c11e84db9325e6f03866c0fc0ec1f6072db03a4013aa914f21990367fc207bfa0f9c41452553d5960881046a034f
SSDEEP:	49152:NY4nch8Bu3BR8XlV10RyTXNFMnBOim8MspczpfEUL:G8VBuRR8X3iRg8kzJ
TLSH:	79B5D077F94434FBEC3050348DA70757A67FB4828362879B2698262A5E57BD42F3AF40
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..T\.FT\.FT\.F.$.G]\.F.$.G.\.F.$.GF\.FD..G^\.FD..GE\.FD..G.\.Fl..GX\.Fl..Gz\.F.$.GQ\.FT\.F.\.F...GS\.Fb..GQ\.F...GU\.FRichT\.

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14003f330
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67386CAC [Sat Nov 16 09:58:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7d70777be1a5623273856e6a9d2b3b2f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FE0F0C375C8h
dec eax
add esp, 28h
jmp 00007FE0F0C36CAFh
int3
int3
dec eax
mov eax, esp
dec esp
mov dword ptr [eax+20h], ecx
dec esp
mov dword ptr [eax+18h], eax
dec eax
mov dword ptr [eax+10h], edx
push ebx
push esi
push edi
inc ecx
push esi
dec eax
sub esp, 38h
dec ebp
mov esi, ecx
dec ecx
mov ebx, eax
dec eax
mov esi, edx
mov byte ptr [eax-38h], 00000000h
dec eax
mov edi, edx
dec ecx
imul edi, eax
dec eax
add edi, ecx
dec eax
mov dword ptr [eax+08h], edi
dec eax
mov eax, ebx
dec eax
dec ebx
dec eax
mov dword ptr [esp+70h], ebx
dec eax
test eax, eax
je 00007FE0F0C36E4Bh
dec eax
sub edi, esi
dec eax
mov dword ptr [esp+60h], edi
dec eax
mov ecx, edi
dec ecx
mov eax, esi
dec eax
mov edx, dword ptr [0002BFECh]
call edx
jmp 00007FE0F0C36E09h
mov byte ptr [esp+20h], 00000001h
dec eax
add esp, 38h
inc ecx
pop esi
pop edi
pop esi
pop ebx
ret
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
dec eax
mov dword ptr [esp+08h], ecx
push edi
inc ecx
push esi
inc ecx
push edi
dec eax
sub esp, 50h
dec ebp
mov esi, ecx
dec ecx
mov esi, eax
dec esp
mov edi, edx
dec eax
mov edi, ecx
xor ebx, ebx
dec eax
mov dword ptr [esp+38h], ebx
dec eax
cmp ebx, esi
je 00007FE0F0C36E4Bh
dec ecx
sub edi, edi
dec eax
mov dword ptr [esp+70h], edi
dec eax
mov ecx, edi
dec ecx
mov eax, esi
call dword ptr [0002BF94h]
dec eax
inc ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x22c744	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x233000	0x468c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x238000	0x1de8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x223aa0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x223c80	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x223960	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6b000	0x378	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x695a0	0x69600	9a2b1fa3d4d578da3d12f49291801967	False	0.5213152431791221	data	6.483309236629047	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6b000	0x1c2318	0x1c2400	d61c239920732c38a8fce8e695ec637f	False	0.7939496503678511	data	7.4458712378603815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22e000	0x44bc	0x2c00	b78b3be2a53d1be3f920dc0961c10337	False	0.11123934659090909	data	2.4644233737167798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x233000	0x468c	0x4800	237495896b73c9e21b14ccac8c962a82	False	0.4833984375	PEX Binary Archive	5.671388566881184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x238000	0x1de8	0x1e00	238b82fb20333b97d53cdf22490ae418	False	0.6766927083333333	data	6.5188501449965255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

ADVAPI32.dll

GetUserNameA

KERNEL32.dll

GetModuleFileNameA, Sleep, GetSystemInfo, GlobalMemoryStatusEx, GetDiskFreeSpaceExA, SetWaitableTimer, ResumeThread, LoadLibraryA, CreateWaitableTimerA, WideCharToMultiByte, GetLastError, GetCurrentProcess, VirtualProtect, VirtualQueryEx, ReadProcessMemory, WriteProcessMemory, VirtualAlloc, VirtualFree, VirtualQuery, GetProcAddress, CloseHandle, CreateFileMappingW, MapViewOfFile, UnmapViewOfFile, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, GetCurrentThreadId, InitializeCriticalSectionEx, QueryPerformanceCounter, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetStringTypeW, GetCPInfo, WakeAllConditionVariable, SleepConditionVariableSRW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, TerminateProcess, CreateFileW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetStdHandle, GetFileType, GetModuleFileNameW, WriteConsoleW, WriteFile, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, OutputDebugStringW, HeapReAlloc, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, ReadFile, ReadConsoleW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, HeapSize, RtlUnwind

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-16T22:03:04.996790+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:04.996790+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:04.996790+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:05.003123+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	45.130.145.152	15666	TCP
2024-11-16T22:03:05.003123+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	45.130.145.152	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 16, 2024 22:03:00.298561096 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:00.304086924 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:00.304517031 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:00.366708040 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:00.366751909 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:00.366985083 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:00.376570940 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:00.376612902 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.003415108 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.003890038 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.194170952 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.194250107 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.195245028 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.195378065 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.235171080 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.275366068 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.417721033 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.417870998 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:01.418181896 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.418183088 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.418556929 CET	49731	443	192.168.2.4	172.67.74.152
Nov 16, 2024 22:03:01.418618917 CET	443	49731	172.67.74.152	192.168.2.4
Nov 16, 2024 22:03:04.996789932 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.002924919 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.002944946 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.002959013 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.002973080 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.002985001 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003123045 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.003303051 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003336906 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003350019 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003362894 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003375053 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.003496885 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.008729935 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008749962 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008760929 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008773088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008785009 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008790016 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.008923054 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.009361029 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.009612083 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.014153957 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014229059 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.014467955 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014687061 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014699936 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.014781952 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.014806032 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014888048 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.014940977 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014954090 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014967918 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014980078 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014985085 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.014996052 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.015005112 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.015017986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.015029907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.015042067 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.015045881 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.015053988 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.015069008 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.015095949 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.015116930 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.021253109 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021265984 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021322966 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.021537066 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021555901 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021568060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021579027 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021591902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021596909 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021606922 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021619081 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021624088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021635056 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021658897 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021672010 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021682978 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021694899 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021699905 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021703959 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021714926 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021724939 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021737099 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021749020 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021759987 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021775961 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021786928 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021799088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021811962 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.021821022 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021832943 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021838903 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021848917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021872044 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021883965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021895885 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021900892 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021934986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021950960 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.021997929 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022010088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022027969 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022072077 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022084951 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022095919 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022110939 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022142887 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022166014 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022166014 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022178888 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022198915 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022202015 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022213936 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022224903 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022237062 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022243023 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022253990 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022273064 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022285938 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022305965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022314072 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022352934 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022365093 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022372007 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022376060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022387981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022408962 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022413969 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022420883 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022435904 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022449970 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022468090 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022481918 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022520065 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.022726059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.022790909 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028341055 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028379917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028491020 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028517008 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028541088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028543949 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028564930 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028590918 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028615952 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028662920 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028697968 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028724909 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028768063 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028774977 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028791904 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028805017 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028816938 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028834105 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028841019 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028867960 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028888941 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028896093 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028913975 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028939009 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028963089 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.028975964 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.028986931 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029004097 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029011965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029030085 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029057026 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029064894 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029084921 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029109955 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029115915 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029131889 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029155970 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029170990 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029180050 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029202938 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029216051 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029247046 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029258966 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029270887 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029294968 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029303074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029318094 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029329062 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029330969 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029352903 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029376030 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029378891 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029419899 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029429913 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029444933 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029469967 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029493093 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029496908 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029515982 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029527903 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029540062 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029550076 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029575109 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029582977 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029603958 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029608965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029633999 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029658079 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029659986 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029689074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029712915 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029735088 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029778004 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029800892 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029819965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029834032 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029845953 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029886007 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029891968 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029917002 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029917955 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029963970 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.029978991 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.029989004 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030014038 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030029058 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030040026 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030065060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030073881 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030100107 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030107975 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030124903 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030133963 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030158997 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030174017 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030183077 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030205965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030214071 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030230045 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030273914 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030298948 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030323982 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030333042 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030348063 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030370951 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030375004 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030404091 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030415058 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030436039 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030440092 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030464888 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030469894 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030488968 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030503035 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030514956 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030538082 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030539036 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030564070 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030565977 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030586958 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030630112 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030632973 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030678034 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030685902 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030703068 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030715942 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030728102 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030744076 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030752897 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030787945 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030796051 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030817032 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030821085 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030846119 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030864954 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030869961 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030893087 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030894995 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030920029 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030934095 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030946016 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030960083 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.030988932 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.030993938 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031013966 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031038046 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031054974 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031064034 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031088114 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031089067 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031112909 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031119108 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031151056 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031155109 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031172991 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031179905 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031204939 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031215906 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031220913 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031259060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031275988 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031284094 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031306982 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031333923 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031354904 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031367064 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031382084 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031407118 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031449080 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031461954 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031474113 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031497955 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031498909 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031522989 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031536102 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031548977 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031563044 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031573057 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031598091 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031601906 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031620979 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031631947 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031645060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031666994 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031688929 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031694889 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031713963 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031737089 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031755924 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031760931 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031785011 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031789064 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031809092 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031821966 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031832933 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031845093 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031857014 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031879902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031884909 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031913996 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031924009 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031939983 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.031950951 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031975985 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.031986952 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.032000065 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.032025099 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.032053947 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.034591913 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.034666061 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037094116 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037112951 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037195921 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037210941 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037226915 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037240982 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037262917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037277937 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037301064 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037314892 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037337065 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037336111 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037349939 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037369013 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037412882 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037415981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037427902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037465096 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037492037 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037514925 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037535906 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037554979 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037580013 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037611008 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037626028 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037669897 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037682056 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037698030 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037702084 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037750006 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037755966 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037761927 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037782907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037821054 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037832022 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037844896 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037851095 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037890911 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037904024 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037910938 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037925005 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037938118 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037940025 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037976980 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.037983894 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.037990093 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038008928 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038012981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038024902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038043976 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038044930 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038058043 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038069963 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038074017 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038105011 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038139105 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038175106 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038187981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038198948 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038209915 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038222075 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038225889 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038227081 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038239002 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038253069 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038264990 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038269997 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038275003 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038284063 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038295984 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038309097 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038321972 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038351059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038352013 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038418055 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038490057 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038501978 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038513899 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038518906 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038541079 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038548946 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038553953 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038558960 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038569927 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038583040 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038589954 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038624048 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038639069 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038657904 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038671970 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038696051 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038707972 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038712978 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038721085 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038734913 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038777113 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038866997 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038880110 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038891077 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038904905 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038916111 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038928986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038939953 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038949013 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.038952112 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038964987 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038975954 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038996935 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.038999081 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039009094 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039020061 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039041042 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039078951 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039110899 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039457083 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039469957 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039480925 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039496899 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039508104 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039520979 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039525986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039535046 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039537907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039550066 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039561987 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039566994 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039566994 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039577961 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039591074 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039602041 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039613962 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039624929 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039633036 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039637089 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039648056 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039659977 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039671898 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039683104 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039688110 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039699078 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039706945 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039710999 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039722919 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039729118 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039733887 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039751053 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039767027 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039772034 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039778948 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039791107 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039803028 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039815903 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039827108 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039838076 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039839029 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039850950 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039861917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039874077 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039885998 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039906025 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039906979 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039920092 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039932013 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039937973 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039947987 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.039948940 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039972067 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039983988 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.039997101 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040009975 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040013075 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040028095 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040035963 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040052891 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040057898 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040111065 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040122986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040132046 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040144920 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040157080 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040170908 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040191889 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040205956 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040214062 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040232897 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040235996 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040247917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040260077 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040301085 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040319920 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040333033 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040400028 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040426970 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040440083 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040479898 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040508032 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.040685892 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040699959 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040710926 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040724993 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040735960 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.040781021 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.083461046 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.083992958 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084214926 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084355116 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084480047 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084594011 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084767103 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.084892035 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085041046 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085139990 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085258961 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085356951 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085470915 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.085532904 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.119308949 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.119741917 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.119863987 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.119930029 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.120011091 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.120042086 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.125257969 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.125781059 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.125893116 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.125936031 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.167537928 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.167845964 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.215380907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.218290091 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.246946096 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.247452021 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247571945 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247642994 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247716904 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247777939 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247833014 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247890949 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.247980118 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.248104095 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.248209953 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.248311996 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.248411894 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.248477936 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.252943993 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.253124952 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.295494080 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.295711040 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296169996 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296236038 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296312094 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296369076 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296416044 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296471119 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296524048 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296576977 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296623945 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296674013 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.296706915 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.307425976 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.307445049 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.307964087 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.308171034 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.308279037 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.308394909 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.313210964 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.313556910 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.313669920 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.313723087 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.355427980 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.355755091 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.403438091 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.403856993 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.414007902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.414048910 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.414645910 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.414745092 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.414805889 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.414884090 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.414942026 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.415011883 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.415071011 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.415168047 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.415210009 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.420005083 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.420325994 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.463335037 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.463546038 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.499476910 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.499526978 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.499800920 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.499907970 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.499969006 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500036001 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500106096 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500262022 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500356913 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500480890 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.500530958 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.504978895 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.505315065 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.505424976 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.505487919 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.505569935 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.505603075 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.547446012 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.547760010 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.569298983 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.569339037 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.569487095 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.569979906 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570085049 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570132971 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570188999 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570240974 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570293903 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570337057 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570390940 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570440054 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570497990 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570542097 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570601940 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570664883 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570774078 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.570827961 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.575136900 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.575347900 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.620455027 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.620718956 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.620831966 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.620899916 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.620971918 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.621023893 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.644928932 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.645209074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645406961 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645509005 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645629883 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645724058 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645848036 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.645941019 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646097898 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646189928 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646302938 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646380901 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646486044 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646573067 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646697998 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.646780014 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.651010036 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.651185036 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.651375055 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.651406050 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.651595116 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652425051 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652452946 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652481079 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652489901 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652508974 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652535915 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652538061 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652565002 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652600050 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652601957 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652631044 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652657986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652658939 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652684927 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652684927 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652709961 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652713060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652735949 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652740955 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652766943 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652766943 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652792931 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652793884 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652820110 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652847052 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652847052 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652873039 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652879953 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652899027 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652906895 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652925968 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652931929 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652952909 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652956009 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.652977943 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.652980089 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653004885 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653006077 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653031111 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653038025 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653058052 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653081894 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653109074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653111935 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653140068 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653167009 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653172016 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653193951 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653198957 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653219938 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653224945 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653247118 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653253078 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653274059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653279066 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653301001 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653310061 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653327942 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653335094 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653354883 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653359890 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653382063 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653386116 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653408051 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653409958 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653435946 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653462887 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653465986 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653490067 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653493881 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653517008 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653543949 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653549910 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653570890 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653578043 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653599024 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653600931 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653625965 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653626919 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653651953 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653652906 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653680086 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653681993 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653706074 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653726101 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653733015 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653757095 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653780937 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653799057 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653841019 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653845072 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653868914 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653897047 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653903008 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653923035 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653928995 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653950930 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.653954983 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653976917 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.653976917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654001951 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654006004 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654032946 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654035091 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654062986 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654066086 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654094934 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654100895 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654122114 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654129982 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654149055 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654154062 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654175997 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654176950 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654202938 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654215097 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654230118 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654247999 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654257059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654284000 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654285908 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654305935 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654310942 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654336929 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654340982 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654365063 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654366970 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654391050 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654392004 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654417038 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654418945 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654443026 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654448032 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654474974 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654479980 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654506922 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654522896 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654531002 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654544115 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654556990 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654568911 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654577971 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654580116 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654592037 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654603958 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654604912 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654616117 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654628038 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654634953 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654639959 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654652119 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654664040 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654675961 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654687881 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654689074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654699087 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654710054 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654721975 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654732943 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654736996 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654743910 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654756069 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654767990 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654773951 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654779911 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654791117 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654803038 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654814005 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654814959 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654836893 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654853106 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654865026 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654866934 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654876947 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654890060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654901981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654911041 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654913902 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654925108 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654937029 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654939890 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.654947996 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654959917 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654972076 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654983044 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654988050 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654993057 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.654998064 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655003071 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655002117 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655013084 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655018091 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655030012 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655040979 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655052900 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655064106 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655075073 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655086994 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655100107 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655117989 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655122995 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655129910 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655141115 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655153990 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655165911 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655179024 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655190945 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655200005 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655201912 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655215979 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655227900 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655240059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655242920 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655251026 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655261993 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655273914 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655284882 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655288935 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655289888 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655296087 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655307055 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655323029 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655328035 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655339956 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655352116 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655363083 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655374050 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655383110 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655385971 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655416012 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655431032 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655432940 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655443907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655456066 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655467987 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655478001 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655479908 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655491114 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655497074 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655508041 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655513048 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655519009 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655530930 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655543089 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655555010 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655559063 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655565977 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655577898 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655590057 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655601978 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655601025 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655613899 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655626059 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655637026 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655641079 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655647993 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655658960 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655670881 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655682087 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655682087 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655694008 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655706882 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655724049 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655725002 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655738115 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655750036 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655772924 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655781031 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655785084 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655797005 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655808926 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655819893 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655821085 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655833960 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655847073 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655853033 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655859947 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655873060 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655884981 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655884027 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655895948 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655908108 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655920029 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655920029 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655931950 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655944109 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655955076 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655956984 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.655966043 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655977964 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.655989885 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656001091 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656003952 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656013012 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656027079 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656039953 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656040907 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656054020 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656066895 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656066895 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656078100 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656090021 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656094074 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656101942 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656114101 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656126022 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656128883 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656136990 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656148911 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656161070 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656167030 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656172991 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656184912 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656196117 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656208038 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656219006 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656224012 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656230927 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656243086 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656255007 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656266928 CET	15666	49730	45.130.145.152	192.168.2.4
Nov 16, 2024 22:03:05.656267881 CET	49730	15666	192.168.2.4	45.130.145.152
Nov 16, 2024 22:03:05.656277895 CET	15666	49730	45.130.145.152	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 16, 2024 22:03:00.354007006 CET	192.168.2.4	1.1.1.1	0x638c	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 16, 2024 22:03:00.361521006 CET	1.1.1.1	192.168.2.4	0x638c	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 16, 2024 22:03:00.361521006 CET	1.1.1.1	192.168.2.4	0x638c	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 16, 2024 22:03:00.361521006 CET	1.1.1.1	192.168.2.4	0x638c	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.74.152	443	7588	C:\Users\user\Desktop\chelentano.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-16 21:03:01 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-11-16 21:03:01 UTC	399	IN	HTTP/1.1 200 OK Date: Sat, 16 Nov 2024 21:03:01 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8e3a6ce11af5316c-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1556&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=738&delivery_rate=1748792&cwnd=246&unsent_bytes=0&cid=2b60669232195e5f&ts=438&x=0"
2024-11-16 21:03:01 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 39 Data Ascii: 173.254.250.69

Target ID:	0
Start time:	16:02:58
Start date:	16/11/2024
Path:	C:\Users\user\Desktop\chelentano.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\chelentano.exe"
Imagebase:	0x7ff73f6d0000
File size:	2'314'240 bytes
MD5 hash:	21506AE1A222C3862C04D187B07ED714
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1767201437.000001A6BCCB9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	50.3%
Signature Coverage:	40.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 000000014007FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 000000014007FB71
GetSystemMetrics.USER32 ref: 000000014007FB7F
GetSystemMetrics.USER32 ref: 000000014007FB8D
GetSystemMetrics.USER32 ref: 000000014007FB9B
GetDC.USER32 ref: 000000014007FBA5
GetDeviceCaps.GDI32 ref: 000000014007FBBB
GetDeviceCaps.GDI32 ref: 000000014007FBCB
CreateCompatibleDC.GDI32 ref: 000000014007FBD8
CreateCompatibleBitmap.GDI32 ref: 000000014007FBF0
SelectObject.GDI32 ref: 000000014007FC06
BitBlt.GDI32 ref: 000000014007FC3C
SHCreateMemStream.SHLWAPI ref: 000000014007FC72
SelectObject.GDI32 ref: 000000014007FC88
DeleteDC.GDI32 ref: 000000014007FC91
ReleaseDC.USER32 ref: 000000014007FC9C
DeleteObject.GDI32 ref: 000000014007FCA5
EnterCriticalSection.KERNEL32 ref: 000000014007FD9C
LeaveCriticalSection.KERNEL32 ref: 000000014007FDAE
IStream_Size.SHLWAPI ref: 000000014007FDE5
IStream_Reset.SHLWAPI ref: 000000014007FDF6
IStream_Read.SHLWAPI ref: 000000014007FE7B
SelectObject.GDI32 ref: 000000014007FED5
DeleteDC.GDI32 ref: 000000014007FEDE
ReleaseDC.USER32 ref: 000000014007FEEB
DeleteObject.GDI32 ref: 000000014007FEF4

Strings

, xrefs: 000000014007FC11

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: e6297d83c5e3daae7c569f233a5639c4317fcd5bbfa91a6b2422efe832d9ecb4
Instruction ID: f318ecd3730808032b5391f8620dce94293df76409b5fe480c5cede521fd26ce
Opcode Fuzzy Hash: e6297d83c5e3daae7c569f233a5639c4317fcd5bbfa91a6b2422efe832d9ecb4
Instruction Fuzzy Hash: 16B11D72218BC086E761DB22E8547EEB7A5F799BC0F408515EB8943B69DF3CC485CB10

Function 00007FF73F6E1F90 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1078
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E32E9

Strings

m_trampolineSz: , xrefs: 00007FF73F6E2CBA
Trampoline Jmp Tbl:, xrefs: 00007FF73F6E2E9A
Trampoline:, xrefs: 00007FF73F6E2D8D
UNKNOWN, xrefs: 00007FF73F6E270C
m_fnAddress: , xrefs: 00007FF73F6E201A, 00007FF73F6E2084
Prologue offset: , xrefs: 00007FF73F6E30D8
failed, xrefs: 00007FF73F6E264F
Hook instructions: , xrefs: 00007FF73F6E2F50
one, xrefs: 00007FF73F6E2A40
Hook size: , xrefs: 00007FF73F6E3046
Chosen detour scheme: , xrefs: 00007FF73F6E273A
ions, xrefs: 00007FF73F6E25AD
Prologue to overwrite:, xrefs: 00007FF73F6E2AC1
m_trampoline: , xrefs: 00007FF73F6E2C16
Original function:, xrefs: 00007FF73F6E22EF

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: one$Chosen detour scheme: $Hook instructions: $Hook size: $Original function:$Prologue offset: $Prologue to overwrite:$Trampoline Jmp Tbl:$Trampoline:$UNKNOWN$failed$ions$m_fnAddress: $m_trampoline: $m_trampolineSz:
API String ID: 3668304517-2571529286
Opcode ID: 6dea04070afc1ebdef79afda176cdc7870c4fc517bbb67051c281ea0f97f1c3c
Instruction ID: 6bd49b0322c687ea4c833af7dc5408803511d5475b286d216a2baf5e3d2f2edd
Opcode Fuzzy Hash: 6dea04070afc1ebdef79afda176cdc7870c4fc517bbb67051c281ea0f97f1c3c
Instruction Fuzzy Hash: 18B2B423A18BC1E5E728EF34D9403E96366FB95788F805232EA4D07796DF79E284D350

Function 00007FF73F6E34B0 Relevance: 36.3, APIs: 12, Strings: 8, Instructions: 1303COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E37E9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73F6E37EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E37F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E37FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E4AD5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E4ADB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E4AE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E4AE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E4AED

Strings

jmp, xrefs: 00007FF73F6E3514
Instructions needing entry:, xrefs: 00007FF73F6E39BC
m_fnAddress: , xrefs: 00007FF73F6E381E
Instructions needing translation:, xrefs: 00007FF73F6E3DFB
Jmp To Prol:, xrefs: 00007FF73F6E46FE
Trampoline address: , xrefs: 00007FF73F6E3F0D
Instructions needing relocation:, xrefs: 00007FF73F6E3B1E
Original function:, xrefs: 00007FF73F6E381C

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $jmp$m_fnAddress:
API String ID: 3936042273-1617887432
Opcode ID: 2486afc1e598fdc772e1ac3ff94fd1bbfdeebacad50be4a655f63a78fa4ee4cb
Instruction ID: 7b0e632a6b3a9bb33c6ff50e96fdc6bad8ce86a64f227c58d9bbbf5e93683afd
Opcode Fuzzy Hash: 2486afc1e598fdc772e1ac3ff94fd1bbfdeebacad50be4a655f63a78fa4ee4cb
Instruction Fuzzy Hash: E0D2AE23A14BD199EB28EF34D9443ED6766EB957D8F804232DA5C07B9ADF38E184D310

Function 00007FF73F6E3810 Relevance: 28.9, APIs: 9, Strings: 7, Instructions: 929COMMON

Download Yara Rule

Strings

Instructions needing entry:, xrefs: 00007FF73F6E39BC
m_fnAddress: , xrefs: 00007FF73F6E381E
Instructions needing translation:, xrefs: 00007FF73F6E3DFB
Jmp To Prol:, xrefs: 00007FF73F6E46FE
Trampoline address: , xrefs: 00007FF73F6E3F0D
Instructions needing relocation:, xrefs: 00007FF73F6E3B1E
Original function:, xrefs: 00007FF73F6E381C

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID:
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $m_fnAddress:
API String ID: 0-38338247
Opcode ID: c4ff25c2c38d411b29f9f0d3f602e45d3cd29d8227800543d42d6121f17002a9
Instruction ID: bd2ba4c6fe77819ddb23a93720bbcddd8884ca802c53d828cae0cec49364ec3c
Opcode Fuzzy Hash: c4ff25c2c38d411b29f9f0d3f602e45d3cd29d8227800543d42d6121f17002a9
Instruction Fuzzy Hash: 97929D23A14BD199EB24AF34C9443EDA766FB957D8F804232DA5C07B9ADF39D284D310

Function 00000001400B98C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400B996D
GetLastError.KERNEL32 ref: 00000001400B9977
FindFirstFileW.KERNEL32 ref: 00000001400B998E
GetLastError.KERNEL32 ref: 00000001400B999A
FindClose.KERNEL32 ref: 00000001400B99A8
__std_fs_open_handle.LIBCPMT ref: 00000001400B9A3B
CloseHandle.KERNEL32 ref: 00000001400B9A51
CloseHandle.KERNEL32 ref: 00000001400B9BC4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction ID: 78d3b7904e2be2efe08361c3f480887f67cd56aa3d30c859a21cd1ed935ad958
Opcode Fuzzy Hash: 9b9cafa6476ba7d57e6375b49b2d31870033937920a690a77e8b0d8031f3f21f
Instruction Fuzzy Hash: 55918132314E4146F6768FABA844BDA27A1AB9D7F0F184714BBBA476F5DB38C841C700

Function 0000000140081660 Relevance: 26.6, APIs: 4, Strings: 10, Instructions: 2133timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0000000140081990

Strings

[UTC, xrefs: 0000000140081963
computer_name, xrefs: 0000000140082954
system, xrefs: 00000001400823E4, 00000001400824D3, 00000001400825C9, 00000001400826C3, 000000014008280B, 0000000140082905, 00000001400829F8, 0000000140082B7F, 0000000140082D70, 0000000140082FF1, 00000001400831B4, 00000001400833CE, 000000014008356D, 0000000140083717, 00000001400837DD
user_name, xrefs: 000000014008242F
gpu, xrefs: 0000000140082522
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140082F5F
cpu, xrefs: 0000000140082618
ram, xrefs: 000000014008285B
timezone, xrefs: 0000000140083414
time, xrefs: 0000000140083041

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 565725191-1610854563
Opcode ID: d3cf83e169ff3f4c24906931b1dd953e86c61076782a8d3af26abcf945dc70e3
Instruction ID: b9f257b62ed73451381ea6531804185a1b92b6541c3fde4c1b208224bb846b02
Opcode Fuzzy Hash: d3cf83e169ff3f4c24906931b1dd953e86c61076782a8d3af26abcf945dc70e3
Instruction Fuzzy Hash: 8D236B73614BC485EB22CF66E8403DD77A1F799798F509215EB9D47BAAEB78C280C700

Function 00007FF73F6D358C Relevance: 23.4, APIs: 9, Strings: 4, Instructions: 639
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF73F6D3840
NtQuerySystemInformation.NTDLL ref: 00007FF73F6D38D0
GetUserNameA.ADVAPI32 ref: 00007FF73F6D399B
GetModuleFileNameA.KERNELBASE ref: 00007FF73F6D3BAB
GetDiskFreeSpaceExA.KERNEL32 ref: 00007FF73F6D3DAC
SleepEx.KERNEL32 ref: 00007FF73F6D3DEB
GetSystemInfo.KERNEL32 ref: 00007FF73F6D3E14
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF73F6D3E3A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D3F02

Strings

zyumznx>knphno=, xrefs: 00007FF73F6D3B31
aqkoh<, xrefs: 00007FF73F6D3AC0
Kn2;0D, xrefs: 00007FF73F6D3636
@, xrefs: 00007FF73F6D3E2D

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: System$InformationNameQuery$DiskFileFreeGlobalInfoMemoryModuleSleepSpaceStatusUser_invalid_parameter_noinfo_noreturn
String ID: @$Kn2;0D$aqkoh<$zyumznx>knphno=
API String ID: 2996925978-1891084399
Opcode ID: c6ef5a57fdbca9f8d3a1e2206873aff3280e9d72684181b437b7f4576ae92ac2
Instruction ID: 824569a5c7805e5c66241b458dd045a3477b0ff6a27121516f8adde83f683bc0
Opcode Fuzzy Hash: c6ef5a57fdbca9f8d3a1e2206873aff3280e9d72684181b437b7f4576ae92ac2
Instruction Fuzzy Hash: 59324B22B296E6A6F71CAF3494012F8A7A5EB88384FC40237E54C47BD5DE3CE516D720

Function 0000000140081FF0 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1516COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140080C30: GetCurrentHwProfileW.ADVAPI32 ref: 0000000140080C6C

Part of subcall function 0000000140080500: EnumDisplayDevicesW.USER32 ref: 0000000140080617
Part of subcall function 0000000140080500: EnumDisplayDevicesW.USER32 ref: 00000001400806BB

Part of subcall function 0000000140080420: RegGetValueA.ADVAPI32 ref: 0000000140080489

Part of subcall function 0000000140080110: GetUserNameW.ADVAPI32 ref: 0000000140080155

Part of subcall function 00000001400801B0: GetComputerNameW.KERNEL32 ref: 00000001400801F5

GlobalMemoryStatusEx.KERNEL32 ref: 000000014008277C
wcsftime.LIBCMT ref: 0000000140082F72
GetModuleFileNameA.KERNEL32 ref: 0000000140083106

Strings

computer_name, xrefs: 0000000140082954
system, xrefs: 00000001400823E4, 00000001400824D3, 00000001400825C9, 00000001400826C3, 000000014008280B, 0000000140082905, 00000001400829F8, 0000000140082B7F, 0000000140082D70, 0000000140082FF1, 00000001400831B4, 00000001400833CE, 000000014008356D, 0000000140083717, 00000001400837DD
user_name, xrefs: 000000014008242F
gpu, xrefs: 0000000140082522
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140082F5F
cpu, xrefs: 0000000140082618
ram, xrefs: 000000014008285B
timezone, xrefs: 0000000140083414
time, xrefs: 0000000140083041

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Name$DevicesDisplayEnum$ComputerCurrentFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 2509368203-1182675529
Opcode ID: e61d77a7accd676b836279c1ede6e893b6c0811bf0262a024843482afec0d740
Instruction ID: 94e5cc0ebb8cc1434cf8510cc9c95a840a40c68f7bc318a096c5be29de2477fb
Opcode Fuzzy Hash: e61d77a7accd676b836279c1ede6e893b6c0811bf0262a024843482afec0d740
Instruction Fuzzy Hash: 3BF25C73614BC099DB22CF66E8903DD77A1F799798F409216EB9D17BA9DB78C280C700

Function 000000014003B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003B90C
GetProcAddress.KERNEL32 ref: 000000014003BA17
GetProcAddress.KERNEL32 ref: 000000014003BAD9
GetProcAddress.KERNEL32 ref: 000000014003BB53
GetProcAddress.KERNEL32 ref: 000000014003BBD5
GetProcAddress.KERNEL32 ref: 000000014003BC4F
GetProcAddress.KERNEL32 ref: 000000014003BCD3
FreeLibrary.KERNEL32 ref: 000000014003C801

Strings

cannot use push_back() with , xrefs: 000000014003C84F
system, xrefs: 000000014003C60D
vault, xrefs: 000000014003C663

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 2a6e3f19ecdff1ea9ffaadaac1c94547f1a58e70e712d370eda34b7674ff9e23
Instruction ID: a54249f8528d4f3be8c91e259b16b1782131f62f239ca1c119aade931fb183f9
Opcode Fuzzy Hash: 2a6e3f19ecdff1ea9ffaadaac1c94547f1a58e70e712d370eda34b7674ff9e23
Instruction Fuzzy Hash: D5925F32215BC489DB62CF26E8843DE73A4F789798F504215EB9C5BBA9EF74C694C700

Function 0000000140076480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140079760: GetCurrentProcess.KERNEL32 ref: 000000014007979B
Part of subcall function 0000000140079760: OpenProcessToken.ADVAPI32 ref: 00000001400797AE
Part of subcall function 0000000140079760: GetTokenInformation.ADVAPI32 ref: 00000001400797EA
Part of subcall function 0000000140079760: CloseHandle.KERNEL32 ref: 000000014007980B

ExitProcess.KERNEL32 ref: 00000001400764C7
OpenMutexA.KERNEL32 ref: 00000001400765E2
ExitProcess.KERNEL32 ref: 00000001400765F2
CreateMutexA.KERNEL32 ref: 0000000140076611
ExitProcess.KERNEL32 ref: 0000000140076637

Part of subcall function 0000000140079AA0: GetModuleFileNameW.KERNEL32 ref: 0000000140079AEA

Part of subcall function 0000000140084740: CoInitializeEx.OLE32 ref: 00000001400847AA

Strings

SeImpersonatePrivilege, xrefs: 00000001400764DA
SeDebugPrivilege, xrefs: 00000001400764CE

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CloseCreateCurrentFileHandleInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 4279366119-3768118664
Opcode ID: b3e0630f4c9362b23b1cfd05753a482c2d05c3af0410e48dacbbc16ec5fa00a8
Instruction ID: d0589101b5e7bde3bc61e22e3420e504ebf615904bad5d0e82a545c1058e7245
Opcode Fuzzy Hash: b3e0630f4c9362b23b1cfd05753a482c2d05c3af0410e48dacbbc16ec5fa00a8
Instruction Fuzzy Hash: 9B618C72218A8081FA22BB66A4553EE6390FB9D7D4F504615F78E436FADF3CC185CA10

Function 00000001400A114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A1191

Part of subcall function 00000001400A07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A080C

Part of subcall function 000000014009B550: HeapFree.KERNEL32 ref: 000000014009B566
Part of subcall function 000000014009B550: GetLastError.KERNEL32 ref: 000000014009B570

Part of subcall function 00000001400A9D94: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A9CDF

_get_daylight.LIBCMT ref: 00000001400A1180

Part of subcall function 00000001400A0858: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A086C

_get_daylight.LIBCMT ref: 00000001400A13F6
_get_daylight.LIBCMT ref: 00000001400A1407
_get_daylight.LIBCMT ref: 00000001400A1418
GetTimeZoneInformation.KERNEL32 ref: 00000001400A143F

Strings

Eastern Summer Time, xrefs: 00000001400A14FD
Eastern Standard Time, xrefs: 00000001400A14E5

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 2c86195adcfd5834508f4e9503c6274a04fe0c4d3ee55324ca76c4afc5113c0b
Instruction ID: cb2aea354cc43386a080a4be0874509c45fd6303dd9085e94252ea63d2a3d950
Opcode Fuzzy Hash: 2c86195adcfd5834508f4e9503c6274a04fe0c4d3ee55324ca76c4afc5113c0b
Instruction Fuzzy Hash: E6D1A43660065086FB22EF37E4517E967A1F7ACBD4F448226FF4987AA5DB38C481CB40

Function 000000014007F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 000000014007F3CB
InternetOpenUrlA.WININET ref: 000000014007F4A8
HttpQueryInfoW.WININET ref: 000000014007F509
HttpQueryInfoW.WININET ref: 000000014007F5A2
InternetQueryDataAvailable.WININET ref: 000000014007F5E6
InternetReadFile.WININET ref: 000000014007F6A9
InternetQueryDataAvailable.WININET ref: 000000014007F774
InternetCloseHandle.WININET ref: 000000014007F81E
Concurrency::cancel_current_task.LIBCPMT ref: 000000014007F87B

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1475545111-0
Opcode ID: baacb7022ef037ed66fea30172715bf4c804657d998897411c6c358c9a2b6b71
Instruction ID: ce928a80c7cff9b54580fc0f9624dc8560371eaf7eb7573381f1f5808c2e681f
Opcode Fuzzy Hash: baacb7022ef037ed66fea30172715bf4c804657d998897411c6c358c9a2b6b71
Instruction Fuzzy Hash: 52027F32A14B9486EB11CB6AE8403AE77B5F7997D8F204215EF9C57BA9DF38C081C700

Function 00000001400BE968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400BE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BE58D
Part of subcall function 00000001400BE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BE60B
Part of subcall function 00000001400BE54C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400BE65C

CreateFileW.KERNEL32 ref: 00000001400BEA6E
CreateFileW.KERNEL32 ref: 00000001400BEABE
GetLastError.KERNEL32 ref: 00000001400BEAEE
GetFileType.KERNEL32 ref: 00000001400BEB03
GetLastError.KERNEL32 ref: 00000001400BEB0D
CloseHandle.KERNEL32 ref: 00000001400BEB40
CloseHandle.KERNEL32 ref: 00000001400BECA3
CreateFileW.KERNEL32 ref: 00000001400BECD8
GetLastError.KERNEL32 ref: 00000001400BECE7

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction ID: 1f4e0671ae6eda90a79519c6e5d71f409463027aeafb3cc91cf2f06a3d0322dc
Opcode Fuzzy Hash: 484b9744f6cc28d441a3ba22cd2a9bb849a09fc1e06d845b9773f87c4c6ec638
Instruction Fuzzy Hash: 71C19D36720A8086EB11CFAAD4917ED3771F79DBE8F015215EB6A9B7A4DB38C456C300

Function 00000001400A13C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A13F6

Part of subcall function 00000001400A0858: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A086C

_get_daylight.LIBCMT ref: 00000001400A1407

Part of subcall function 00000001400A07F8: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A080C

_get_daylight.LIBCMT ref: 00000001400A1418

Part of subcall function 00000001400A0828: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A083C

Part of subcall function 000000014009B550: HeapFree.KERNEL32 ref: 000000014009B566
Part of subcall function 000000014009B550: GetLastError.KERNEL32 ref: 000000014009B570

GetTimeZoneInformation.KERNEL32 ref: 00000001400A143F

Strings

Eastern Summer Time, xrefs: 00000001400A14FD
Eastern Standard Time, xrefs: 00000001400A14E5

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction ID: 24a90bdb08aceee3997b5279fd9eafcb3bdff3fa571b4a0845494e5839021355
Opcode Fuzzy Hash: 94df1ec9e2384a72c79be9da220bb4aa566035efaa8ab6aaac74d351b0b15fee
Instruction Fuzzy Hash: 86516D3261464096F762EF37E8817D97760F79CBC4F44422ABB4987AB6DB38C4818B40

Function 000000014003C8C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003C90A
Process32FirstW.KERNEL32 ref: 000000014003C94C
Process32NextW.KERNEL32 ref: 000000014003CB43
CloseHandle.KERNEL32 ref: 000000014003CDBA

Strings

[PID: , xrefs: 000000014003C98E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: baf24e3afe3209363ad73a0cfdf071b9a604545281296ab33caba5bad70c7be5
Instruction ID: 2638dde17c8d9d49267d472b5da948808293535ce8eecdd1b7ae6527acc1649c
Opcode Fuzzy Hash: baf24e3afe3209363ad73a0cfdf071b9a604545281296ab33caba5bad70c7be5
Instruction Fuzzy Hash: F0E18F72614BC085EB22DB26E8803DE67A5F7897E8F504215FB9D47BA9DF78C294C700

Function 00007FF73F6D4554 Relevance: 7.7, APIs: 5, Instructions: 226timelibrarythreadCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF73F6D45ED
LoadLibraryA.KERNEL32 ref: 00007FF73F6D4714
CreateWaitableTimerA.KERNEL32 ref: 00007FF73F6D478F
SetWaitableTimer.KERNEL32 ref: 00007FF73F6D47B7
ResumeThread.KERNEL32 ref: 00007FF73F6D4827

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: TimerWaitable$CreateLibraryLoadResumeSleepThread
String ID:
API String ID: 2864272952-0
Opcode ID: 85f8fc62dfd02435b4dffcc8576b057b1c145ce789bd07f9788faaa7b8b7e451
Instruction ID: 64f686fd6cb89a57e5c268a423b4f62855b124ea9bcf5e2d16985306ca6003c5
Opcode Fuzzy Hash: 85f8fc62dfd02435b4dffcc8576b057b1c145ce789bd07f9788faaa7b8b7e451
Instruction Fuzzy Hash: 3E919067A046D2E7EB18AF65D4505F9A3A6FB45BD4B804036EE0D07B84DF3CE8619710

Function 0000000140085970 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400859BE
OpenProcessToken.ADVAPI32 ref: 00000001400859D1
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400859F2
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140085A38
CloseHandle.KERNEL32 ref: 0000000140085A58

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction ID: 34ce752f9ab4a56b2deac93a7bd861715a39945583b4098be1e1f478c1badeef
Opcode Fuzzy Hash: 29a02e95aae9899e0029659e102052f54fff5397b51cb33b914b83ea41570e5f
Instruction Fuzzy Hash: 4A216832218B8086E7618B62F88438AB7A4FB8CBD0F558125FB8957B68DF7CC545CB00

Function 000000014003ACC0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 671COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 000000014003AD22
CredFree.ADVAPI32 ref: 000000014003B746

Strings

cannot use push_back() with , xrefs: 000000014003B794

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: 883c792fbab307b5e421ac1b095e8b1444d52e8822cbffabf230e8b0b4400744
Instruction ID: 36f6f23de775bbde7fb143acede6b28c36744b506e3723a123fcb712a0b7f3e8
Opcode Fuzzy Hash: 883c792fbab307b5e421ac1b095e8b1444d52e8822cbffabf230e8b0b4400744
Instruction Fuzzy Hash: 2F625072614BC489EB22CF66E8903DE77A1F789798F505315EB9D17BA9DB38C284C700

Function 0000000140071EA0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140071EF8
LocalFree.KERNEL32 ref: 0000000140071F8A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction ID: 1012aa67ab5575fa7dabbc20d00f8a9710edfb2bddd748b72b5be8e93224168a
Opcode Fuzzy Hash: 534917215b691bdf8008ca3940d01222a19eb5e5d5bf9c8332b99172fc4e0cb2
Instruction Fuzzy Hash: D2413232614B80CAE3218F75E4403ED37A4F79978CF444229FB8817E9ADB79C6A4C754

Function 00007FF73F6E9700 Relevance: 1.7, Strings: 1, Instructions: 432COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6EA08A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6EA090
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6EA096

Strings

nop, xrefs: 00007FF73F6E9A24

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: nop
API String ID: 3668304517-258488684
Opcode ID: f17234b282f812c14c95624dee4ce68ed202b886a0915112ef8017143ffaa727
Instruction ID: 1a10623cd8d07bb01fd98aa0a064c96dcdb46a439537c7047ff178f2eec2079d
Opcode Fuzzy Hash: f17234b282f812c14c95624dee4ce68ed202b886a0915112ef8017143ffaa727
Instruction Fuzzy Hash: 1912D133A08BD299EB249F25D9443EDA3A6EF557D8F844231DA9C07AD9DF39E180D310

Function 00000001400813B0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000000140081421

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction ID: 762c538b592356dff3a6ce454e42c970aaa603d24f9c2a176b6a2edc9c8e9b7a
Opcode Fuzzy Hash: 05563d9c9f8d9765ab942f76f343afa8ceddb3167ad04ffcdfa04968ca2d4d44
Instruction Fuzzy Hash: A8416D33A18B8082E711CF25E8803DEB774F798788F555215EB8823A79DB78D6D1DB40

Function 00007FF73F6D4AC0 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtMakeTemporaryObject.NTDLL ref: 00007FF73F6D4B23

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: MakeObjectTemporary
String ID:
API String ID: 2645245090-0
Opcode ID: 6a862c28f31d64bcf16794884afac330a1f7b54cdfb20a1835c7e509fe9ea051
Instruction ID: fff0cfafba3205781474d87239343b9d9b8b8ad7d69bde9826e14e6bbae670b4
Opcode Fuzzy Hash: 6a862c28f31d64bcf16794884afac330a1f7b54cdfb20a1835c7e509fe9ea051
Instruction Fuzzy Hash: EFF0C972909B81EADB1CEB51F8450A9B765FF987C0B404835EA8C47725CF3CE060AB64

Function 00007FF73F71FFBC Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 213e0517995829b4433645234137e2cf3142657ebec2bc9b121cc5dc926dacfd
Instruction ID: 69e9db0b4c4b31b6493da3ca03a46706c81244b268f29e7c4d7e3270bd7b2882
Opcode Fuzzy Hash: 213e0517995829b4433645234137e2cf3142657ebec2bc9b121cc5dc926dacfd
Instruction Fuzzy Hash: 4D81D476A04A95A6EB28EF25D8803BC63A0FB48BD4FC44636EE1D47795CF38E0419320

Function 0000000140078B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400788B0: InitializeCriticalSectionEx.KERNEL32 ref: 0000000140078901
Part of subcall function 00000001400788B0: GetLastError.KERNEL32 ref: 000000014007890B

EnterCriticalSection.KERNEL32 ref: 0000000140078B71
GdiplusStartup.GDIPLUS ref: 0000000140078B98
LeaveCriticalSection.KERNEL32 ref: 0000000140078BA6
LeaveCriticalSection.KERNEL32 ref: 0000000140078BD4
GdipGetImageEncodersSize.GDIPLUS ref: 0000000140078BE2
GdipGetImageEncoders.GDIPLUS ref: 0000000140078C76
GdipCreateBitmapFromScan0.GDIPLUS ref: 0000000140078D40
GdipSaveImageToStream.GDIPLUS ref: 0000000140078D5E
GdipDisposeImage.GDIPLUS ref: 0000000140078DC3
GdipDisposeImage.GDIPLUS ref: 0000000140078DD7

Strings

&, xrefs: 0000000140078D3A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: 524f3fd988fd5da9a142abe3460ca7494f5175dc71200abd548d20379ee1c311
Instruction ID: 91ca7ef0bf8a51011a936eb11742b6bb682dc54b826b12b3f90657a60efb070d
Opcode Fuzzy Hash: 524f3fd988fd5da9a142abe3460ca7494f5175dc71200abd548d20379ee1c311
Instruction Fuzzy Hash: 23914B32240B809AEB228F22E8407D977A4F76CBD8F558215FF4957BA4DB38C996C350

Function 0000000140079BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007F890: GetUserGeoID.KERNEL32 ref: 000000014007F8B7
Part of subcall function 000000014007F890: GetGeoInfoA.KERNEL32 ref: 000000014007F8D1
Part of subcall function 000000014007F890: GetGeoInfoA.KERNEL32 ref: 000000014007F921

WSAStartup.WS2_32 ref: 0000000140079D59
socket.WS2_32 ref: 0000000140079D7A
htons.WS2_32 ref: 0000000140079DA0
inet_pton.WS2_32 ref: 0000000140079DE3
connect.WS2_32 ref: 0000000140079DFD
closesocket.WS2_32 ref: 0000000140079E1C
WSACleanup.WS2_32 ref: 0000000140079E22

Strings

system, xrefs: 0000000140079CC5
geo, xrefs: 0000000140079D06

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: c7777637b258e530dbc954033b76ffb5a805f2f32057b730cb4fd4f5f2b81010
Instruction ID: 285a129e456712ba6082bcc77ad357df936d975360b878f49f16957cea3e4a12
Opcode Fuzzy Hash: c7777637b258e530dbc954033b76ffb5a805f2f32057b730cb4fd4f5f2b81010
Instruction Fuzzy Hash: 53C18B72B11B4085FB02DBA6E4503DC33A2A799BA8F414216EB1D6B6F9DE38C546C300

Function 0000000140083B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140083B61
GetProcessId.KERNEL32 ref: 0000000140083B6A
RmStartSession.RSTRTMGR ref: 0000000140083B8A
RmRegisterResources.RSTRTMGR ref: 0000000140083BB5
RmGetList.RSTRTMGR ref: 0000000140083BEE
RmGetList.RSTRTMGR ref: 0000000140083C50
RmEndSession.RSTRTMGR ref: 0000000140083C8B
RmEndSession.RSTRTMGR ref: 0000000140083CC2
RmEndSession.RSTRTMGR ref: 0000000140083CD7

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: 66a0440454f858689b4cb82879d8a312e600f7eccee216c674467dbce1873752
Instruction ID: 4da0510642fd848fb8bcf76b3320aaf3fb59ff25f31ccd2a24b64a59eb708cf8
Opcode Fuzzy Hash: 66a0440454f858689b4cb82879d8a312e600f7eccee216c674467dbce1873752
Instruction Fuzzy Hash: E2511732B14A518AFB15CFA6E4547DD73A1BB8C788F50512AEF0A67BA8DF34C906C740

Function 00007FF73F6E7F80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FF73F6E7FB7
LoadLibraryA.KERNEL32 ref: 00007FF73F6E800F
GetProcAddress.KERNEL32 ref: 00007FF73F6E8024
GetCurrentProcess.KERNEL32 ref: 00007FF73F6E802D
VirtualAlloc2.KERNELBASE ref: 00007FF73F6E805B

Strings

kernelbase.dll, xrefs: 00007FF73F6E7FF9
VirtualAlloc2, xrefs: 00007FF73F6E801A

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: ee9e691f3339f1b8678635fd649736d1d6724eaee0207cfec3d84d95d58957b8
Instruction ID: 2a73725512bd7cd908725986bd5c7898ac6aad1c659bdf8d362864e0561224f1
Opcode Fuzzy Hash: ee9e691f3339f1b8678635fd649736d1d6724eaee0207cfec3d84d95d58957b8
Instruction Fuzzy Hash: 2E214C36B08B8192EB10CB15F4483A9B7A4FB89B80F944236EB8D03764DF7DD195CB40

Function 000000014009D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009DA1D

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction ID: 841b2728c93b3887653dc9800ffbd716b7e6352b756ce4ae0355bef11b2994df
Opcode Fuzzy Hash: 197761c4084f71b538abde1851977105dd70471639988d7dce5d49f8975dacdd
Instruction Fuzzy Hash: 79C1E13224878592EB639B5794407EE7BA4F799BC0F5A4112FB8A037B2DF79C859C301

Function 00007FF73F6D9760 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73F6D9775
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73F6D979A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73F6D97C4
std::_Facet_Register.LIBCPMT ref: 00007FF73F6D983B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73F6D9855
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73F6D9868

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e1b166543a53702fe14943f6d3da6476f2ee8035fa3cb2c4c17bf39e30227ea5
Instruction ID: 2315719dd0c0283422d39523cac7978eb6cb3e52575757d2fa51213743974c5a
Opcode Fuzzy Hash: e1b166543a53702fe14943f6d3da6476f2ee8035fa3cb2c4c17bf39e30227ea5
Instruction Fuzzy Hash: 3A31C422A086D3A0EA19BF15D8001F8E366EF44BE4F881532EA0D472A9DE3CE455D321

Function 0000000140078990 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00000001400789D3
EnterCriticalSection.KERNEL32 ref: 00000001400789E5
EnterCriticalSection.KERNEL32 ref: 00000001400789F5
GdiplusShutdown.GDIPLUS ref: 0000000140078A03
LeaveCriticalSection.KERNEL32 ref: 0000000140078A10
LeaveCriticalSection.KERNEL32 ref: 0000000140078A1A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction ID: c9ca659fb5a3d6881cb484776de8e1e5d4a8d55f00fea3343c422757f577f082
Opcode Fuzzy Hash: 83031f1c3d95a3b59bc2a22e43b72ccd41805d9851eefa9cc92077698de98015
Instruction Fuzzy Hash: 0B111332101B4091FB129F26E8443AD73A4FB58FA8F684216EB69076B4DF38C997C350

Function 00007FF73F6D4320 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 133COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D4535

Strings

nd 3, xrefs: 00007FF73F6D438B
expa, xrefs: 00007FF73F6D4384
2-by, xrefs: 00007FF73F6D4392
te k, xrefs: 00007FF73F6D4399

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 2-by$expa$nd 3$te k
API String ID: 3668304517-3581043453
Opcode ID: 3b2f1e77da82971571ebb1b64f8b5a91f52f215159679f9b82a4ad03c8c99f16
Instruction ID: 3ca9b0074d061e754929628bd134f107d7bbc65551470d65fa324cc04e477a65
Opcode Fuzzy Hash: 3b2f1e77da82971571ebb1b64f8b5a91f52f215159679f9b82a4ad03c8c99f16
Instruction Fuzzy Hash: A551BA73A18BD19BE714DF69E4403ADB7A5F784398F90423AEA5C1BA88DF38D415CB10

Function 00007FF73F6D4BF0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF73F6D4C13
ReadProcessMemory.KERNEL32 ref: 00007FF73F6D4C3C
GetLastError.KERNEL32 ref: 00007FF73F6D4C50
VirtualQueryEx.KERNEL32 ref: 00007FF73F6D4C6E
ReadProcessMemory.KERNEL32 ref: 00007FF73F6D4C9D

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: 490604cf631213c4f7d4bc8b53f009a007d38b9b330d27ad8b9b0915c93be651
Instruction ID: 57690eeccddb0f211d26e34ef3b3e66bae1009cb39fc7ec0a27f50eb8b052214
Opcode Fuzzy Hash: 490604cf631213c4f7d4bc8b53f009a007d38b9b330d27ad8b9b0915c93be651
Instruction Fuzzy Hash: 76217132608BC5A2EA645F12E504BA9E3A9FB58FC4F844033EE5C43B54CF3CE5519750

Function 00007FF73F6DDBD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF73F6DDC4F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF73F6DDC97
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF73F6DDD36

Strings

bad locale name, xrefs: 00007FF73F6DDD5E

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: bb31426e4975f7316b5c6ef063c998f1dbeecb8845509a8ad3d2d8caecd9f0db
Instruction ID: 1cdd9b6fbf934308d58febb7207e0c3b3dc8594f4860277266714a110770c9cd
Opcode Fuzzy Hash: bb31426e4975f7316b5c6ef063c998f1dbeecb8845509a8ad3d2d8caecd9f0db
Instruction Fuzzy Hash: 03415127A0AB81E9EB18FF60D4502ED63B9EF48788F840835EE4C17A45DE38E5259364

Function 000000014007E9F0 Relevance: 6.4, APIs: 4, Instructions: 417networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014007EBCC
recv.WS2_32 ref: 000000014007F0AC
closesocket.WS2_32 ref: 000000014007F0BE
WSACleanup.WS2_32 ref: 000000014007F0C4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 119812952f032c4019b3f725c9fc04c2943c3ccae372477230373a14daec7cf2
Instruction ID: 8f90e498ecfe37442e4cb8d9bb0550216e7919a8ac38086568310a5e78a47168
Opcode Fuzzy Hash: 119812952f032c4019b3f725c9fc04c2943c3ccae372477230373a14daec7cf2
Instruction Fuzzy Hash: A8127D72618BC081EA22DB26E4553DAA761F7DD7E0F504216EBAD47AEADF7CC580C700

Function 0000000140079760 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014007979B
OpenProcessToken.ADVAPI32 ref: 00000001400797AE
GetTokenInformation.ADVAPI32 ref: 00000001400797EA
CloseHandle.KERNEL32 ref: 000000014007980B

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction ID: 144575f0deb0e9815bcc8e8dc4aca1776a187f33cbba52a0c54232388bc02d8c
Opcode Fuzzy Hash: 5cf106d3b2ffd2a7e9a61a7f883b18dc6c947c023f1ec599732081f4b0d6fdce
Instruction Fuzzy Hash: 2E11FB32219B8086EB519F16F84038BB7A1FB89BC0F599125FB9957B68CF3CC456CB40

Function 0000000140080420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 0000000140080489

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 000000014008047B
ProductName, xrefs: 0000000140080474

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction ID: 26ea67e421c70577f1e0c3ab239bea92f6106dcb702c6358f79fbb29e0ad476a
Opcode Fuzzy Hash: 4b31b020cac4b58e91cc22bf7df28ffde147e0876d00deb1f16a5955c36cd2ac
Instruction Fuzzy Hash: DA116032218B8086E761CF22F4413DAB3A4F79DB94F515216EB9807B69DFBCC155CB40

Function 00000001400810A0 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140081129
RegEnumKeyExA.ADVAPI32 ref: 000000014008116E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction ID: 5512091da0cbc6cd73f4513cc040b23e9187fd4e3f47f1afb6a08641439c0744
Opcode Fuzzy Hash: a8920e58832bf877e089fa0af907033f7a3b2d639e35d700202a240f283f6ca3
Instruction Fuzzy Hash: A0317E32610B8485F721CFA2E844BDE7764FB997D8F204215EF9957A64DF78C692C700

Function 00007FF73F70F1BC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73F70EDAC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73F70EDC0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF73F70F1E0
__scrt_release_startup_lock.LIBCMT ref: 00007FF73F70F24E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF73F70F2A1

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: ca5095f9f0934c8dcb10c6eb8d6758b74392b30f2ff198211e2c5aacfc8ee1c1
Instruction ID: 4c29c67354a8f715262592b339de8e8c35cfa30d0d91c883a0ee4f2fd259ff14
Opcode Fuzzy Hash: ca5095f9f0934c8dcb10c6eb8d6758b74392b30f2ff198211e2c5aacfc8ee1c1
Instruction Fuzzy Hash: E3315929A1D5C372FA5CBB64A8113F9A291DF493C4FC44035E94D4B2D7CE6CB84AA272

Function 000000014007F890 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 000000014007F8B7
GetGeoInfoA.KERNEL32 ref: 000000014007F8D1
GetGeoInfoA.KERNEL32 ref: 000000014007F921

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 3bc4dc8b205c8f5e86355db1c7d37ea7e16e754cf88f8655ed4f115315335814
Instruction ID: 8b5ee01ef88d727dc76fcb086716a614bb15383b0d222ccb43ef0a8bca5a155e
Opcode Fuzzy Hash: 3bc4dc8b205c8f5e86355db1c7d37ea7e16e754cf88f8655ed4f115315335814
Instruction Fuzzy Hash: 0611BF3261478582E7119F62F51079EB3A1FB98FC8F045224EF8503B69DF7CD5908B84

Function 0000000140080C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 0000000140080C6C

Strings

Unknown, xrefs: 0000000140080D26

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction ID: 3e2fa29568d11d1f5a996732cbc4d5e05cc6a294b75f1d6f72ac71020be503a2
Opcode Fuzzy Hash: 327d7d51cf89ce8cae5e34d504ec04f85fc3bceab43135c4ad84e114b6f625fa
Instruction Fuzzy Hash: C3319C33628BC086E7528F22E5403DAA760F7D9B84F545215FBC917A6ADB7CC695CB00

Function 00007FF73F6ED990 Relevance: 3.2, APIs: 2, Instructions: 239COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73F70C73C: GetCurrentThreadId.KERNEL32 ref: 00007FF73F70C78D
Part of subcall function 00007FF73F70C73C: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,00007FF73F6ED7F8,?,?,?,?,?,00000000,?,00007FF73F6DF036), ref: 00007FF73F70C7AC

std::_Throw_Cpp_error.LIBCPMT ref: 00007FF73F6EDCA7
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF73F6EDCB2

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AcquireCurrentExclusiveLockThread
String ID:
API String ID: 819584676-0
Opcode ID: 302b13fe02147a03c01b2f1579b1d2d468bc84a40fc0edb99238a591d773af4d
Instruction ID: 8bf12b366719cb6d12b27abcdfebc3ef58ec3960ded159d7c517d6ade4e52048
Opcode Fuzzy Hash: 302b13fe02147a03c01b2f1579b1d2d468bc84a40fc0edb99238a591d773af4d
Instruction Fuzzy Hash: C5912273708AA0D2DA58AF25D644279F3AAFB88BD0B898032DB5D47755DE3DD442C710

Function 00007FF73F6ED7C0 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FF73F6ED92C
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF73F6ED937

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 8e3aeff37c88ccf3a6fa36c33444dfc1bc0dd36012cd1caa14f6e5121c297ec8
Instruction ID: da3e82abe6794fb2837605803abb4fa0b92f64a6270ce5c492ac918890afee79
Opcode Fuzzy Hash: 8e3aeff37c88ccf3a6fa36c33444dfc1bc0dd36012cd1caa14f6e5121c297ec8
Instruction Fuzzy Hash: 93412537A086D1C2EB28AB26D4402ADA3A5FB98FD4F5C4131DB8D47796CE2DD841DB10

Function 0000000140078E10 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000000140078E69
CoTaskMemFree.OLE32 ref: 0000000140078F2A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: a442a38656185b6b65161427b3884d9092c58ae80b0ece02cdbb5bb680eef673
Instruction ID: e0922fc889aabda0f678259bd8a1d27f145056e1d3b083c73cdcd55e4bf8acb9
Opcode Fuzzy Hash: a442a38656185b6b65161427b3884d9092c58ae80b0ece02cdbb5bb680eef673
Instruction Fuzzy Hash: 3B315272A14B8481E721CF6AE44139EB761F79D7E4F505316FBAC43AA9DB7CC1818B40

Function 0000000140077390 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00000001400773E1
RegCloseKey.ADVAPI32 ref: 00000001400773F3

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 33579b64be932ee1adaf6035fef093b9a7736483f65c6bed23fb5657630c88d8
Instruction ID: e9443b259e2ff5e769b0daaa1292e56475e382c592423062085a76afa0c8a150
Opcode Fuzzy Hash: 33579b64be932ee1adaf6035fef093b9a7736483f65c6bed23fb5657630c88d8
Instruction Fuzzy Hash: F121BF32710A8085FA529B22E8407EAA760EB9DBD4F585221FF4D43BBADB7CC581C700

Function 000000014009DB60 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000000014009DBAC
GetLastError.KERNEL32 ref: 000000014009DBB6

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction ID: 0a2fa258feb8b01d7de52e36993dff2ecf07ca3983954f37093da69aceb6b73a
Opcode Fuzzy Hash: 7e9ab1c6d8c64915d6648e9c143c2363700413bfa3c055332623f50353a46816
Instruction Fuzzy Hash: 7C119E72214B8081EA219B2AE84439DB361E799BF4F544312FF794B7E9CF78C0518700

Function 00000001400358F3 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140035936
FindClose.KERNELBASE ref: 0000000140035958

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction ID: ecad7f01f66b79fa710e5962096eba47fe8f75f9ecd59c154f0dbbe5f1464cfe
Opcode Fuzzy Hash: c09ff1b7f36846cd2f70e20038cef65db65028f9499b4e4cc306786389cb5efe
Instruction Fuzzy Hash: CD01EC36218A8185EA62DB52F85439B6364F7DDBD4F804022DF8D43B69DE38C8868B00

Function 00007FF73F70ED34 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73F70ED64

Part of subcall function 00007FF73F70C57C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF73F70C585

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73F70ED6A

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 165452f2f7277d6ed3a06b87a4f69957e1f2300d44031e13ac042c3ef071d8ad
Instruction ID: 66e7aa60aac7ef16b78ccba7d8ae7eaf5033d56f6a709fd4ffb88c58e8ebc571
Opcode Fuzzy Hash: 165452f2f7277d6ed3a06b87a4f69957e1f2300d44031e13ac042c3ef071d8ad
Instruction Fuzzy Hash: 41E0B649E2958B62F92C32611C561F481408F5D3F0EE81B30E93D0A2D7AD1CB5956672

Function 00007FF73F6D32BC Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D32EA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF73F6D32F0

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: cfa1755a0aa82b0f7f368fc0a85c1cf19868f536946038b675d804a82711a901
Instruction ID: ff7706979aee559ed947170f054f2c0ad4a74fb9e46a2e200d16c9aebd87fbca
Opcode Fuzzy Hash: cfa1755a0aa82b0f7f368fc0a85c1cf19868f536946038b675d804a82711a901
Instruction Fuzzy Hash: 2CE08C56E06787A1EC1CB3A184930B942958F883B0ED00F30E63C067C2ED2CB4626220

Function 000000014009B550 Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014009B566
GetLastError.KERNEL32 ref: 000000014009B570

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 31eb857e7b2226c7b656d9114bec736a780ec52add63351ab0fcaaedff7179f8
Instruction ID: f6169e75486995b8cfd2b5c6041e3332aad15b7110b3a4412abb221213ab08d3
Opcode Fuzzy Hash: 31eb857e7b2226c7b656d9114bec736a780ec52add63351ab0fcaaedff7179f8
Instruction Fuzzy Hash: 3AE05E75B11A0582FF1B67F399A93ED12956FADBD1F058530BB15832B2EE3888954210

Function 0000000140080250 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00000001400802E0

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 2a00b1a0eed9fcd5efd147b76d63c0988b6e0613cc5591b1d12a293245ad4a8b
Instruction ID: dd742eef3eb71578eb0a38c21647134830ba85d75451c89411c41e56ebe2e84b
Opcode Fuzzy Hash: 2a00b1a0eed9fcd5efd147b76d63c0988b6e0613cc5591b1d12a293245ad4a8b
Instruction Fuzzy Hash: A3519E33A14B808AE712CF69E8443DD73B4F799788F505216EB9C57AA9DF78C684CB40

Function 00007FF73F6F936E Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF73F6F93FE

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 85e78becf5e0b393c28cc3bf2d0f3cb5e4f07d43e8bed05addc3f9719ad868ea
Instruction ID: cb46890d5d0a814e68acbdb0ffa541eb6dd4ad09b7980a3e3cd0445a9b07d621
Opcode Fuzzy Hash: 85e78becf5e0b393c28cc3bf2d0f3cb5e4f07d43e8bed05addc3f9719ad868ea
Instruction Fuzzy Hash: 5A315E12E18AC2DAF3129BB8D4153FCB371EF6534DF456220DE886287AEF3862D59351

Function 00007FF73F6F93A0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF73F6F93FE

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 31cfbb304dbb38aa9956329e73355eff859b8526e685caf864eafee6b5224503
Instruction ID: 0c31095a18fc550e52e9a09fdc0f22c04a232d2a6750cfaa1ca74cbea703142d
Opcode Fuzzy Hash: 31cfbb304dbb38aa9956329e73355eff859b8526e685caf864eafee6b5224503
Instruction Fuzzy Hash: 28313B12E18AC6AAF3169FB890013FCA371AFA434DF456331DE4962839EF3562D9D350

Function 00007FF73F7240D8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73F724103

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3996bf036a137b91db98cb56a751e6bc7bfa4dee88faa39515da7531d3e44c23
Instruction ID: dff3217270637e4ffe9b2f489df61222514fe652cff3f7601123a3fd6a1899c8
Opcode Fuzzy Hash: 3996bf036a137b91db98cb56a751e6bc7bfa4dee88faa39515da7531d3e44c23
Instruction Fuzzy Hash: FB11E776A04B4AADEB15EFA0D8812EC37B4FB0839CF900536EA4D12B59DF34D195C7A0

Function 000000014007ADC0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 000000014007AE08

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction ID: 2712cb1e368439583ef0ff8b3452ad06edf40515ac0b4633c3b1e7322f7c7dab
Opcode Fuzzy Hash: af342f55a76444dc29af71e8fb4152a83f454f5b800a0383b076c9e997804f61
Instruction Fuzzy Hash: 33018B35714A8482EB518F1BF94039AA3A0F78DBD4F585134EF5E43B58EA38C8918B00

Function 00007FF73F6F96E0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF73F6FA0C4), ref: 00007FF73F6F96F4

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0685d7b19520df5c67a0e8c3580d37c6a02a096465734ab015583635341ef8b9
Instruction ID: 5af6eff1056c47f17911d99e6ea7fcba96fde22a66819ba31b7bc487801be052
Opcode Fuzzy Hash: 0685d7b19520df5c67a0e8c3580d37c6a02a096465734ab015583635341ef8b9
Instruction Fuzzy Hash: 30F01D30F187869BDB4CDB1DA81126977E2F788744F804139E54EC37A8DE2CE8118B50

Function 00007FF73F6D4BA0 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF73F6D4BC7

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 51f90e94aeca4c95b2cd34b2a5ed23752a343929b840a27942d17f55598ccede
Instruction ID: 22012fd4946c25d44542f13ebcc9594fb0d2d4f40f5d006e0ca06d59a14d36d9
Opcode Fuzzy Hash: 51f90e94aeca4c95b2cd34b2a5ed23752a343929b840a27942d17f55598ccede
Instruction Fuzzy Hash: 52E092237182D5E2D704AB26F5841FAE362BB99BC0B944035EE9C07716CD2DD801DF50

Function 00000001400B97D0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400B97D4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction ID: d343e42f0501e0478ce046e7b4ad1d26ec59c9f722ce7e036319c61eb3e5a038
Opcode Fuzzy Hash: 4177796e15072c585db232ab642f29accb6d05ea1f689265af403d42f2bb1474
Instruction Fuzzy Hash: 9EC09B39F55D06C1F6551F735C4238A11E47B7D781F408060D30482170DD3C81D74721

Function 00000001400BB3C4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400BB3CD

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction ID: d8588725117227abdcdc34116d9b2bcb0c60ff49f8bf55b53c216b4b3b5310f7
Opcode Fuzzy Hash: 5d96549d17151685d9874b2efd5e6665c09aeaad6767ec6861ada1b691878f94
Instruction Fuzzy Hash: 58B0923AA148C0C3D612EB04E84224A7331FBA8B0CFD00000E78D42624CE2CCA2A8E00

Function 00007FF73F6E8540 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF73F6DEFF1), ref: 00007FF73F6E8549

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 25cf75335121583dfdfec9cb8cd8dee3505061b7bcd7ce15733641bd302c82b6
Instruction ID: 83c78048e4989349eb336b2a1e847b2de7f9857171d22d4960eb3b17819f5e8e
Opcode Fuzzy Hash: 25cf75335121583dfdfec9cb8cd8dee3505061b7bcd7ce15733641bd302c82b6
Instruction Fuzzy Hash: 28B09B25E149C4D3C521FB04D9450557371F79CB04FC00151D14D41714DE1CD6198E00

Function 00007FF73F6FA0A0 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73F6F96E0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF73F6FA0C4), ref: 00007FF73F6F96F4

InitializeCriticalSection.KERNEL32 ref: 00007FF73F6FA170

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: b63e4777be97870028eb3e82a7e7475413f5be94e8a6e66ceb6330b743b8c388
Instruction ID: 446f2458e3bbe79096cd0f8c35da526f1028bf588507244222b56b65b2e66941
Opcode Fuzzy Hash: b63e4777be97870028eb3e82a7e7475413f5be94e8a6e66ceb6330b743b8c388
Instruction Fuzzy Hash: 4441AC32E05B89DAE714DF12E84059EFBA9FB68BD0B858035CF9943B50DB38E890C710

Function 000000014009BBB8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009BC0D

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 89c4a105d1922272e2462610b84ed45905b4a23a50f1930c6b4ffa1c52014e05
Instruction ID: 6c531239d40ee5e4a2902b226633eb57cac5011e2b9d900c6599e8325af725e8
Opcode Fuzzy Hash: 89c4a105d1922272e2462610b84ed45905b4a23a50f1930c6b4ffa1c52014e05
Instruction Fuzzy Hash: AAF090B030520980FE575B679A513E512805B9CBD0F0C8531BB1A873F2DE7CC5814220

Function 000000014009DEDC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009DF1A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9205f215ad2653e1577bdd25e83756dbf467762e7c9e560a58e2579e2ecf73cf
Instruction ID: 96e13d477e2ea5b68fd7ccafc69e1366d973b9abeb779e8dcccaf29a9117702d
Opcode Fuzzy Hash: 9205f215ad2653e1577bdd25e83756dbf467762e7c9e560a58e2579e2ecf73cf
Instruction Fuzzy Hash: A8F0A03035124584FE172BB358227E932905B9C7E0F0847327F3B872E1DA3CC4818110

Function 00007FF73F726FE8 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF73F729AE1,?,?,00000000,00007FF73F72E203,?,?,?,00007FF73F722CA3,?,?,?,00007FF73F722B99), ref: 00007FF73F727026

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 32880910578a27a9564e9d5d69925be913ad7062b9b1684f8e7dd551eca65773
Instruction ID: cca226f8aeb48d1f87b5510503318dc41ad5338beca6d2fec76049ecba4ba137
Opcode Fuzzy Hash: 32880910578a27a9564e9d5d69925be913ad7062b9b1684f8e7dd551eca65773
Instruction Fuzzy Hash: 0BF03A08E0C28A70FA6C3B625E416F9D1A0DF8C7E0FC81630D82E852D2DE6CB4466270

Non-executed Functions

Function 00007FF73F6D8070 Relevance: 67.4, APIs: 16, Strings: 22, Instructions: 916COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF73F6E5EB0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E6008
Part of subcall function 00007FF73F6E5EB0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6E600E

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FB2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FBE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FC4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FCA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FD0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FD6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FDC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6D8FE2

Strings

c2 ?? ?? cc cc cc cc cc cc 66 0f 1f 44 00 00, xrefs: 00007FF73F6D86AE
c3 0f 1f 44 00 00, xrefs: 00007FF73F6D85C7
c3 cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D8629
c3 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D860D
c3 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D85F1
c2 ?? ?? , xrefs: 00007FF73F6D8476, 00007FF73F6D8534
c3 cc cc cc cc cc cc 66 0f 1f 44 00 00, xrefs: 00007FF73F6D85FF
c2 ?? ?? 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D8692
c2 ?? ?? cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D86D8
, xrefs: 00007FF73F6D80E2
c3 cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D8637
c3 cc cc cc cc cc cc 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D861B
, xrefs: 00007FF73F6D842C
c2 ?? ?? cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D86E6
c3 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D85D5
c2 ?? ?? 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D86BC
c2 ?? ?? cc cc cc cc cc cc 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D86CA
c2 ?? ?? 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D8684
c2 ?? ?? 0f 1f 44 00 00, xrefs: 00007FF73F6D8676
c2 ?? ?? 66 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D86A0
c3 , xrefs: 00007FF73F6D8162, 00007FF73F6D81D3
c3 66 0f 1f 84 00 00 00 00 00, xrefs: 00007FF73F6D85E3

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $ $c2 ?? ?? $c2 ?? ?? 0f 1f 44 00 00$c2 ?? ?? 0f 1f 84 00 00 00 00 00$c2 ?? ?? 66 0f 1f 84 00 00 00 00 00$c2 ?? ?? 66 66 0f 1f 84 00 00 00 00 00$c2 ?? ?? 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00$c2 ?? ?? cc cc cc cc cc cc 66 0f 1f 44 00 00$c2 ?? ?? cc cc cc cc cc cc 66 0f 1f 84 00 00 00 00 00$c2 ?? ?? cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00$c2 ?? ?? cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00$c3 $c3 0f 1f 44 00 00$c3 0f 1f 84 00 00 00 00 00$c3 66 0f 1f 84 00 00 00 00 00$c3 66 66 0f 1f 84 00 00 00 00 00$c3 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00$c3 cc cc cc cc cc cc 66 0f 1f 44 00 00$c3 cc cc cc cc cc cc 66 0f 1f 84 00 00 00 00 00$c3 cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00$c3 cc cc cc cc cc cc cc 66 66 0f 1f 84 00 00 00 00 00
API String ID: 3668304517-3837975418
Opcode ID: b42931ba09c89b7cc0914b28a1dde43ef4ef91879d0b312a5abf58d8d17061c7
Instruction ID: a928a8fe4a8d337016203c284bf334a4779ee78d7e59e4a9870a9c2adde4f3b5
Opcode Fuzzy Hash: b42931ba09c89b7cc0914b28a1dde43ef4ef91879d0b312a5abf58d8d17061c7
Instruction Fuzzy Hash: E392F623A14BD2A5EB189B34D5483ECA366FB457D4F905232EA9C06BE9DF7CE180D350

Function 00000001400843F0 Relevance: 34.3, APIs: 18, Strings: 1, Instructions: 1015stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 0000000140084433
NtAllocateVirtualMemory.NTDLL ref: 000000014008446B
lstrcpyW.KERNEL32 ref: 00000001400844CD
lstrcatW.KERNEL32 ref: 0000000140084582
NtAllocateVirtualMemory.NTDLL ref: 0000000140084609
lstrcpyW.KERNEL32 ref: 00000001400846BC
RtlInitUnicodeString.NTDLL ref: 00000001400846D1
RtlInitUnicodeString.NTDLL ref: 00000001400846E6
LdrEnumerateLoadedModules.NTDLL ref: 00000001400846F9
RtlReleasePebLock.NTDLL ref: 00000001400846FF

Part of subcall function 0000000140078E10: SHGetKnownFolderPath.SHELL32 ref: 0000000140078E69
Part of subcall function 0000000140078E10: CoTaskMemFree.OLE32 ref: 0000000140078F2A

CoInitializeEx.OLE32 ref: 00000001400847AA
lstrcpyW.KERNEL32 ref: 0000000140084989
lstrcatW.KERNEL32 ref: 0000000140084B8E
CoGetObject.OLE32 ref: 0000000140084BAC
lstrcpyW.KERNEL32 ref: 0000000140085229
lstrcatW.KERNEL32 ref: 000000014008544C
CoGetObject.OLE32 ref: 000000014008546A
CoUninitialize.OLE32 ref: 0000000140085932

Strings

0, xrefs: 000000014008506A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: 0
API String ID: 1424456515-4108050209
Opcode ID: 6ab5860048078404b08774eb621f8c2ed188637054e4c41919c08ed4710e8169
Instruction ID: d1b0b74d629fbdfa23808d7784c7a9837c07540af2c9878b2135e3a3a2eb4a86
Opcode Fuzzy Hash: 6ab5860048078404b08774eb621f8c2ed188637054e4c41919c08ed4710e8169
Instruction Fuzzy Hash: E3C29736626F848AD7918F6AE88169DB3B5F788B88F105219FECD57B18EF38C154C740

Function 0000000140006180 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

iconcache.db, xrefs: 00000001400062DE
boot.sdi, xrefs: 00000001400064D1
ntldr, xrefs: 0000000140006292
mib.bin, xrefs: 0000000140006444
boot.ini, xrefs: 00000001400061D1
indexervolumeguid, xrefs: 0000000140006473
gdipfontcachev1.dat, xrefs: 00000001400063B7
ntuser.dat, xrefs: 0000000140006304
bootmgr, xrefs: 000000014000655E
ntuser.ini, xrefs: 0000000140006359
wpsettings.dat, xrefs: 00000001400064A2
winre.wim, xrefs: 0000000140006500
BOOTNXT, xrefs: 000000014000658D
bootstat.dat, xrefs: 0000000140006415
desktop.ini, xrefs: 000000014000626C
thumbs.db, xrefs: 0000000140006388
bootmgfw.efi, xrefs: 00000001400061F9
bootsect.bak, xrefs: 0000000140006246
winsipolicy.p7b, xrefs: 00000001400062B8
autorun.inf, xrefs: 00000001400061A8
d3d9caps.dat, xrefs: 00000001400063E6
ntuser.dat.log, xrefs: 000000014000632D
bootfont.bin, xrefs: 0000000140006220
reagent.xml, xrefs: 000000014000652F

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction ID: a421a36a023068aa29fcad27acd30c2338e587ed8756a21bd3deff31cd8c958e
Opcode Fuzzy Hash: dea6d34053270f54165e7821960ee4cc20a6cc02140d0cf59d37aac2e2ba149c
Instruction Fuzzy Hash: D0C12362D70BC985E722DB36DC923E55361F7EE384F506316BA8866866EB74E3C4C340

Function 000000014004C820 Relevance: 29.3, APIs: 2, Strings: 14, Instructions: 1339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004DEA1
Concurrency::cancel_current_task.LIBCPMT ref: 000000014004DF4F

Part of subcall function 000000014002B930: __std_exception_copy.LIBVCRUNTIME ref: 000000014002B973

Part of subcall function 00000001400AF198: RtlPcToFileHeader.KERNEL32 ref: 00000001400AF1E8
Part of subcall function 00000001400AF198: RaiseException.KERNEL32 ref: 00000001400AF229

Strings

object is not closed with '}', xrefs: 000000014004DD9F
*, xrefs: 000000014004CB3D
#include, xrefs: 000000014004D1F9
unexpected '}', xrefs: 000000014004DF7C
/, xrefs: 000000014004CB12
key opened, but never closed, xrefs: 000000014004DF28
Unexpected eof, xrefs: 000000014004DD72
", xrefs: 000000014004CD13
No closed word, xrefs: 000000014004DEA7, 000000014004DECE
key declared, but no value, xrefs: 000000014004DDED, 000000014004DE14, 000000014004DF01
quote was opened but not closed., xrefs: 000000014004DDC6, 000000014004DE3B
word wasnt properly ended, xrefs: 000000014004DF55
unexpected key without object, xrefs: 000000014004DE7A
#base, xrefs: 000000014004D225

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-3561477107
Opcode ID: 361d72bd4709def6a4f609f4fa24ae8153a654784caad3b90ac2d429779cc2c6
Instruction ID: 922a43b0bfb3320b1e09c0a69905fec27db791f2e7b910ff19e93df92efef7e5
Opcode Fuzzy Hash: 361d72bd4709def6a4f609f4fa24ae8153a654784caad3b90ac2d429779cc2c6
Instruction Fuzzy Hash: A5D27E72210BC499EB729F26D8543DD33A1F749BD8F458222EB4D1BAA9DF74C685C304

Function 0000000140005DB0 Relevance: 25.2, Strings: 20, Instructions: 202COMMON

Download Yara Rule

Strings

AppData, xrefs: 0000000140005FE7
ntldr, xrefs: 0000000140006016
$recycle.bin, xrefs: 0000000140005DD8
$windows.~bt, xrefs: 0000000140005F0E
All users, xrefs: 0000000140006074
PerfLogs, xrefs: 0000000140005F34
Program Files (x86), xrefs: 0000000140006101
ProgramData, xrefs: 0000000140006045
Windows.old, xrefs: 0000000140005EE8
$winreagent, xrefs: 0000000140005F5D
bootmgr, xrefs: 00000001400060A3
System Volume Information, xrefs: 0000000140005E76
Windows, xrefs: 0000000140005E01
$windows.~ws, xrefs: 0000000140005F89
config.msi, xrefs: 0000000140005EC2
Boot, xrefs: 0000000140005E50
Application Data, xrefs: 0000000140005E9C
Windows.~bt, xrefs: 0000000140005FB8
Program Files, xrefs: 00000001400060D2
#recycle, xrefs: 0000000140005E29

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 118556049-2722463023
Opcode ID: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction ID: cb1f1a79905c169176f84319a286e819c3d1305308cc080649ce1386deffbe9a
Opcode Fuzzy Hash: b349f0743e28fad41dd0cf6d04c419ecc5bc303b8eb5692233894048f4044c83
Instruction Fuzzy Hash: EFA13762D71FC985E712DB36DC923E55321F7EE388F506306BA8866866EB74E2C4C340

Function 000000014004E320 Relevance: 24.1, APIs: 2, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004FA31
Concurrency::cancel_current_task.LIBCPMT ref: 000000014004FB06

Strings

No closed word, xrefs: 000000014004FA37, 000000014004FA5E
object is not closed with '}', xrefs: 000000014004F92F
#include, xrefs: 000000014004ED8A
key declared, but no value, xrefs: 000000014004F97D, 000000014004F9A4, 000000014004FAB8
unexpected '}', xrefs: 000000014004FB33
quote was opened but not closed., xrefs: 000000014004F956, 000000014004F9CB
key opened, but never closed, xrefs: 000000014004FADF
Unexpected eof, xrefs: 000000014004F902
word wasnt properly ended, xrefs: 000000014004FA85, 000000014004FB0C
unexpected key without object, xrefs: 000000014004FA0A
#base, xrefs: 000000014004EDB6

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-1838291449
Opcode ID: b5287aff4d33eed72af7018457b4126d96b056adf5592194d94a81707646957f
Instruction ID: f45671f661cca8ad8b6fc8505681403b41097a2b46c11b6a0eabc4bca19b9bc9
Opcode Fuzzy Hash: b5287aff4d33eed72af7018457b4126d96b056adf5592194d94a81707646957f
Instruction Fuzzy Hash: ACE28D72211BC489EB72DF26D9503ED23A1F749BD8F454222EB4D0BAA9DF78C685D304

Function 0000000140083CF0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0000000140083D36
GetProcAddress.KERNEL32 ref: 0000000140083D46
OpenProcess.KERNEL32 ref: 0000000140083D78
NtQuerySystemInformation.NTDLL ref: 0000000140083DA0
NtQuerySystemInformation.NTDLL ref: 0000000140083DCE
GetCurrentProcess.KERNEL32 ref: 0000000140083E93
NtQueryObject.NTDLL ref: 0000000140083ED9
GetFinalPathNameByHandleA.KERNEL32 ref: 0000000140083FCD
CloseHandle.KERNEL32 ref: 00000001400840E8
CloseHandle.KERNEL32 ref: 0000000140084178

Strings

NtDuplicateObject, xrefs: 0000000140083D3F
File, xrefs: 0000000140083F0A
ntdll.dll, xrefs: 0000000140083D2F

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 83ec5291b0018ab41cfe03df20e7dd2d1f1a72359edb3c28957622346f052dbc
Instruction ID: 5f06b0e0e128540174c09338d6285e380c67aae915a26e8c51ec70aeb0794474
Opcode Fuzzy Hash: 83ec5291b0018ab41cfe03df20e7dd2d1f1a72359edb3c28957622346f052dbc
Instruction Fuzzy Hash: 10E18F73B14A8089FB11DBA6D4143ED27A1F799BD8F408121EF5D57BA9DE38C68AC340

Function 00000001400751E0 Relevance: 21.5, APIs: 1, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 0000000140075767

Strings

ios_base::eofbit set, xrefs: 000000014007598C
ios_base::failbit set, xrefs: 0000000140075985
.vbs, xrefs: 00000001400752D2
ios_base::badbit set, xrefs: 000000014007597A
.exe, xrefs: 000000014007532D
runas, xrefs: 00000001400756E6
.cmd, xrefs: 00000001400752A3
open, xrefs: 00000001400756DD
.exe, xrefs: 0000000140075245
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000000140075374
.ps1, xrefs: 0000000140075274

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 587946157-4093014531
Opcode ID: 5fa60de95bd03661044e3fc0dac292e7a1a752f4b59490dd2e6ebca0d811477b
Instruction ID: b5281d601738a43ca211a99e1055133fc5e051f27855edb02c4b0c1275ff8ddc
Opcode Fuzzy Hash: 5fa60de95bd03661044e3fc0dac292e7a1a752f4b59490dd2e6ebca0d811477b
Instruction Fuzzy Hash: 70229C72A20B8489EB11DF29E8803DD37A1F7887A8F505216FB5D47AB9DFB8C584C740

Function 0000000140084740 Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400843F0: RtlAcquirePebLock.NTDLL ref: 0000000140084433
Part of subcall function 00000001400843F0: NtAllocateVirtualMemory.NTDLL ref: 000000014008446B
Part of subcall function 00000001400843F0: lstrcpyW.KERNEL32 ref: 00000001400844CD
Part of subcall function 00000001400843F0: lstrcatW.KERNEL32 ref: 0000000140084582

CoInitializeEx.OLE32 ref: 00000001400847AA
lstrcpyW.KERNEL32 ref: 0000000140084989
lstrcatW.KERNEL32 ref: 0000000140084B8E
CoGetObject.OLE32 ref: 0000000140084BAC
lstrcpyW.KERNEL32 ref: 0000000140085229
lstrcatW.KERNEL32 ref: 000000014008544C
CoGetObject.OLE32 ref: 000000014008546A
CoUninitialize.OLE32 ref: 0000000140085932

Strings

0, xrefs: 000000014008506A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID: 0
API String ID: 3636535045-4108050209
Opcode ID: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction ID: 8c7b09bbf5c7122b16ba28e428a853a3eff83895a479c57ea2f3f9a8387bf1b3
Opcode Fuzzy Hash: 148f1cac526a25eedb59746f716de0c0cfa115320cfb54a3382c2084b1ee678e
Instruction Fuzzy Hash: 2BB2973662AFC58AD7808F69E88165EB7B5F788B88F106215FECD57B18EB38C154C740

Function 000000014007AE50 Relevance: 13.2, APIs: 2, Strings: 4, Instructions: 2695COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 000000014007E393
cannot compare iterators of different containers, xrefs: 000000014007E43F, 000000014007E4EF, 000000014007E61F
type must be string, but is , xrefs: 000000014007E3FD, 000000014007E4AD, 000000014007E571, 000000014007E5CB
value, xrefs: 000000014007B688

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 118556049-2711811579
Opcode ID: a2dba7e70cf099fd7a4de2094bb4a85c1ef6e3937679e5fa4afee9f10795526d
Instruction ID: e60008f7f84b6c3740a31766efd91a03ab009c2b7edee56fda540ab7752bb5c8
Opcode Fuzzy Hash: a2dba7e70cf099fd7a4de2094bb4a85c1ef6e3937679e5fa4afee9f10795526d
Instruction Fuzzy Hash: E9535972611BC489EB72DF26D8803DD33A5F749798F509616EB5D5BAAAEF34C284C300

Function 0000000140078F60 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 451fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00000001400791A1
SetFilePointer.KERNEL32 ref: 0000000140079254
ReadFile.KERNEL32 ref: 0000000140079283

Strings

ios_base::eofbit set, xrefs: 00000001400796C4
ios_base::failbit set, xrefs: 00000001400796BD
ios_base::badbit set, xrefs: 00000001400796B1, 000000014007972F
exists, xrefs: 000000014007970A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: b548caa736ec3c348e1439c5da8914f590a63263b627fd5598bf14829292a84c
Instruction ID: 5edffb9c9e573463b4dd48dfa20c5045759caa4cd85463c1147fb348f9822fd8
Opcode Fuzzy Hash: b548caa736ec3c348e1439c5da8914f590a63263b627fd5598bf14829292a84c
Instruction Fuzzy Hash: 35320432615BC489EB21CF36D8807DD37A1F789B88F548226EB4D5BBA9EB74C645C700

Function 00000001400A6F14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400981FC: GetLastError.KERNEL32 ref: 000000014009820B
Part of subcall function 00000001400981FC: FlsGetValue.KERNEL32 ref: 0000000140098220
Part of subcall function 00000001400981FC: SetLastError.KERNEL32 ref: 00000001400982AB

TranslateName.LIBCMT ref: 00000001400A6F7E
TranslateName.LIBCMT ref: 00000001400A6FB9
GetACP.KERNEL32 ref: 00000001400A7000
IsValidCodePage.KERNEL32 ref: 00000001400A7038
GetLocaleInfoW.KERNEL32 ref: 00000001400A71F5

Strings

utf8, xrefs: 00000001400A711C

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction ID: c8676370c03f2832b14b5ac92e44ce7c7e0275684d35be30625b5c07bc7d450d
Opcode Fuzzy Hash: 4309449c26b629e9b6de698707476955217e9cbe9722d2e68f3c85218e94a805
Instruction Fuzzy Hash: B6918C3230074086FB669F63D841BE923A4F7ACBC0F448225BF59477A6DB79C996CB40

Function 00000001400A795C Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400981FC: GetLastError.KERNEL32 ref: 000000014009820B
Part of subcall function 00000001400981FC: FlsGetValue.KERNEL32 ref: 0000000140098220
Part of subcall function 00000001400981FC: SetLastError.KERNEL32 ref: 00000001400982AB

Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 0000000140098241
Part of subcall function 00000001400981FC: FlsGetValue.KERNEL32 ref: 00000001400982E1

GetUserDefaultLCID.KERNEL32 ref: 00000001400A7ACC

Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 000000014009826E
Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 000000014009827F
Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 0000000140098290
Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 0000000140098300
Part of subcall function 00000001400981FC: FlsSetValue.KERNEL32 ref: 0000000140098328

EnumSystemLocalesW.KERNEL32 ref: 00000001400A7AB3
ProcessCodePage.LIBCMT ref: 00000001400A7AF6
IsValidCodePage.KERNEL32 ref: 00000001400A7B08
IsValidLocale.KERNEL32 ref: 00000001400A7B1E
GetLocaleInfoW.KERNEL32 ref: 00000001400A7B7A
GetLocaleInfoW.KERNEL32 ref: 00000001400A7B96

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 3301e9280f1409413c6e5163e9b0fada1059872855e0caf1ff3eea5915758eb7
Instruction ID: feb63dcf0bdec3949d4e76bc79658d237640d57012ff30aab0ceb24d224915c4
Opcode Fuzzy Hash: 3301e9280f1409413c6e5163e9b0fada1059872855e0caf1ff3eea5915758eb7
Instruction Fuzzy Hash: 73718F7271061099FB269B62DC50BEC33A4BBAC7C4F448225AF1D577E5EB38C585CB21

Function 0000000140064710 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00000001400648C4
__std_exception_destroy.LIBVCRUNTIME ref: 00000001400648D2
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140064B55
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140064B63

Strings

value, xrefs: 00000001400647EA, 0000000140064A83

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 1c2ba53565f946c9080e6b53425894bea7830ffcab37d4544949e565ea5696af
Instruction ID: b1c523dfb46d95ff63a91890f65b1b3e8e807c93fa61b7d9179ce92ad787025e
Opcode Fuzzy Hash: 1c2ba53565f946c9080e6b53425894bea7830ffcab37d4544949e565ea5696af
Instruction Fuzzy Hash: 4E029F32A24BC085EB02CB76D8803EE6761E7997E4F605615FB9D47AEADF78C185C700

Function 0000000140088B70 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140088D24
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140088D32
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140088FB5
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140088FC3

Strings

value, xrefs: 0000000140088C4A, 0000000140088EE3

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 04f4b7c235365a1010fc6c63079ea135c62ed19ee5361597eed9e8b3ec8bad99
Instruction ID: 970f2944975341a257ab404fa4abbac2a857008dc3ac11f7c0c90d2f312cbe8b
Opcode Fuzzy Hash: 04f4b7c235365a1010fc6c63079ea135c62ed19ee5361597eed9e8b3ec8bad99
Instruction Fuzzy Hash: 1A028A33A24B8089EB12DB76D4843ED6761F7997E4F505212FB9D43AEADB78C285C700

Function 000000014008F920 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 000000014008F999
RtlLookupFunctionEntry.KERNEL32 ref: 000000014008F9B1
RtlVirtualUnwind.KERNEL32 ref: 000000014008F9EC
IsDebuggerPresent.KERNEL32 ref: 000000014008FA25
SetUnhandledExceptionFilter.KERNEL32 ref: 000000014008FA2F
UnhandledExceptionFilter.KERNEL32 ref: 000000014008FA3A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction ID: 5f8d02a2a52773e592abde51a21ef668a942117cb33230e5cbd38566097d7bbb
Opcode Fuzzy Hash: c7f70f128318b326f672a7b0d6647dc5eb587961ea58d1b4d09a7c2ba848fd84
Instruction Fuzzy Hash: C3314E32214B8096EB61CF26E8403EE73A4F798794F540116FB9D43BA9DF38C155CB10

Function 0000000140039090 Relevance: 8.4, Strings: 6, Instructions: 916COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000000014003A1D4
filename, xrefs: 0000000140039BE9
files, xrefs: 0000000140039EE5
key, xrefs: 00000001400395ED, 00000001400397CD
exists, xrefs: 000000014003A167, 000000014003A182
content, xrefs: 0000000140039D62

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: d2e8c5784b7336250cda634c7e7f077fe517af5955372375b5b4bdb43e8c1d63
Instruction ID: db886dd1511d2bf5be93a71c4dec273d0f001a764d79c9cfe459ddf8002fb08e
Opcode Fuzzy Hash: d2e8c5784b7336250cda634c7e7f077fe517af5955372375b5b4bdb43e8c1d63
Instruction Fuzzy Hash: 83A25B72611BC48ADB228F36D8843DE73A5F799798F505616EB9C4BBA9DF74C280C340

Function 00007FF73F72D02C Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF73F72D078
FindFirstFileExW.KERNEL32 ref: 00007FF73F72D182

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 3e0a43cd693a05410b509f488a5a0548e281c97be78be681143cf9592b373582
Instruction ID: f742f75fb5aa9e60998a71ad69eb2e998f84be4add254252d09c485086eced2d
Opcode Fuzzy Hash: 3e0a43cd693a05410b509f488a5a0548e281c97be78be681143cf9592b373582
Instruction Fuzzy Hash: E1B1C42AB186DAB1EA68AB21EC041F9E391EB48BD0FC45135DE5D47B85DF3CF441A310

Function 0000000140037B8D Relevance: 7.4, Strings: 5, Instructions: 1142COMMON

Download Yara Rule

Strings

config, xrefs: 0000000140037F9D
filename, xrefs: 0000000140037E06, 000000014003818E, 0000000140038A22
status, xrefs: 0000000140039027
content, xrefs: 0000000140037E5F, 00000001400381E7, 0000000140038B04
users, xrefs: 0000000140038522

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: config$content$filename$status$users
API String ID: 0-2677590375
Opcode ID: a9a058be19f95ffe05f0a44f403eb0c6d5e3b0d8bd0c1896b65ef1cfdc461b5a
Instruction ID: 88bed40317cff88bec96c74472af5b50869bd5d48732fb9cc8dfc92afe38185a
Opcode Fuzzy Hash: a9a058be19f95ffe05f0a44f403eb0c6d5e3b0d8bd0c1896b65ef1cfdc461b5a
Instruction Fuzzy Hash: 8DC26072611BC589DB32DF36D8943DD63A1F789798F405216EB9D4BAAAEF34C684C300

Function 00000001400BBB14 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BBB75
IsDebuggerPresent.KERNEL32 ref: 00000001400BBB8D
OutputDebugStringW.KERNEL32 ref: 00000001400BBB9E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400BBB97

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction ID: 9dc1694343e02967c11c7c3d0e29f81101dece21e8fb3b6c562d59960a48fa23
Opcode Fuzzy Hash: e8ffe009acab376759065dd43441e42d099b308a5e20a56206d0bc25ee25ae09
Instruction Fuzzy Hash: 00115A32210B40A7F75A9B67EA843ED33A0FB58785F408125EB4983A61EF78D0B4C720

Function 00000001400302E0 Relevance: 7.0, Strings: 5, Instructions: 747COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0000000140030F42, 0000000140030F92
filename, xrefs: 000000014003088E
status, xrefs: 0000000140030F58, 0000000140030F6E
exists, xrefs: 0000000140030F26
content, xrefs: 0000000140030946

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3645842244-3429737954
Opcode ID: 5ece81433d9ff37a7c059390fab1d368b36a848333c2fa9aefaf8ad46434897e
Instruction ID: d73ea0c104233689a445c32717ff6da1951ca3655a894b6c35e9ca85daf2ae71
Opcode Fuzzy Hash: 5ece81433d9ff37a7c059390fab1d368b36a848333c2fa9aefaf8ad46434897e
Instruction Fuzzy Hash: 53726032611BC089EB62DF36D8903EE6360F78D798F549625EB8D47AA9DF74C684C700

Function 0000000140061340 Relevance: 6.8, Strings: 5, Instructions: 599COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 00000001400620E3, 0000000140063764
cannot use push_back() with , xrefs: 0000000140062095
status, xrefs: 00000001400620D1, 00000001400620F3, 000000014006211B, 0000000140062143
exists, xrefs: 000000014006374D
prefs.js, xrefs: 00000001400628A2

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 28fca9b23354bd683b427f2f8d1bb70e567294dfa82398b1eaf78fa5c7db42d7
Instruction ID: 63d978f2dda3e68515005d76a2ef6ca3ac3a7e1fa577548c5563e2d706d29ac1
Opcode Fuzzy Hash: 28fca9b23354bd683b427f2f8d1bb70e567294dfa82398b1eaf78fa5c7db42d7
Instruction Fuzzy Hash: E1522632609FC484E6729B16E8813DAB3A4F7C9784F505626EBCC53B69EF78C594CB00

Function 0000000140097348 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 000000014009739F
GetSystemInfo.KERNEL32 ref: 00000001400973B8
VirtualAlloc.KERNEL32 ref: 0000000140097426
VirtualProtect.KERNEL32 ref: 0000000140097441

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction ID: d91057414ffa4c73b9b01bd033ad8b4648322d2f3e60c39491e11190a2f9d873
Opcode Fuzzy Hash: 324fd5cd604fef47d1152131e1f7c01459585a6c12e9a2e3e67a5e0172bc20d3
Instruction Fuzzy Hash: 88313536310A819EEB21CF32D8547D963A5F74DB88F95802AAA4D4BB69DB38D646C700

Function 0000000140068950 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000140068BAE

Strings

parse_error, xrefs: 00000001400689DE
value, xrefs: 00000001400698D3

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 3e116b332420aacf114edbbec7826855a4b42931067101207a73c55646cc7bb8
Instruction ID: 8244d5c1f1ed087e50a97b553c421f27148c391dfb4737c9bdab5d2393af6ecf
Opcode Fuzzy Hash: 3e116b332420aacf114edbbec7826855a4b42931067101207a73c55646cc7bb8
Instruction Fuzzy Hash: 4BF1BF72A20A8095EB12DF76E8513ED2362F79D7D8F905612FB5C17AAAEF74C184C340

Function 000000014003A1F0 Relevance: 5.6, Strings: 4, Instructions: 609COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 000000014003AC83
filename, xrefs: 000000014003A7A9
exists, xrefs: 000000014003AC67
content, xrefs: 000000014003A94F

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: e2373231b1ff66b0894e044b160cc32f93b85538415c22739f29677aec00290d
Instruction ID: af20b811e710999986ff35a911c3500b010dfb73ffacbcf88ee0eea74d4bf58c
Opcode Fuzzy Hash: e2373231b1ff66b0894e044b160cc32f93b85538415c22739f29677aec00290d
Instruction Fuzzy Hash: DC527F73624BC489EB628F26E8403DE73A1F789798F405215EB9D47BA9EF78C584C700

Function 00000001400A19B8 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400A1DEE
_get_daylight.LIBCMT ref: 00000001400A1E89
_get_daylight.LIBCMT ref: 00000001400A1EA2

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 626dcb227b5bc7ac8be461749a241f678d20af3c8eaaec26e2b9a3e8116e3e07
Instruction ID: b718dfecaa3ddfc3bc52139a138ba4e290b4b0cd523622613b77e9720c13a749
Opcode Fuzzy Hash: 626dcb227b5bc7ac8be461749a241f678d20af3c8eaaec26e2b9a3e8116e3e07
Instruction Fuzzy Hash: 9292F43320578086E7668F2AE5503ED37A5F7ADBC8F548225FB8507BA5DB39C991CB00

Function 0000000140088240 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000140088423

Strings

out_of_range, xrefs: 00000001400882B2
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 000000014008854F

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$out_of_range
API String ID: 592178966-2497706888
Opcode ID: 58b4b1ac7839a45aacf2307d221f6284d641360b3ebd18aeb6119a6f3cf397e6
Instruction ID: 859cc02d407c1f41063c26cd0541dd94ca3be4aad8ee5ef7ae090caff03dabfc
Opcode Fuzzy Hash: 58b4b1ac7839a45aacf2307d221f6284d641360b3ebd18aeb6119a6f3cf397e6
Instruction Fuzzy Hash: 42A19073B14B8085EB12CB6AD4553EC2362F79DBD8F509212EF5D17BAADA78C295C300

Function 00000001400B9480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400B94A6
FormatMessageA.KERNEL32 ref: 00000001400B94D9

Strings

!x-sys-default-locale, xrefs: 00000001400B9499

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction ID: f3a926f20b1b010318398b7a8846d58a51c33b94a468237811250e05d48ce9cb
Opcode Fuzzy Hash: f19c835850623712fbca22d426e0c2013945c380ca8add72a55f3f09a2f97b50
Instruction Fuzzy Hash: 27018C72704B8082E7228F53B550BEA67A2F7987C4F548015EB8547BA9CB3CC545C700

Function 00000001400706A6 Relevance: 4.4, Strings: 3, Instructions: 653COMMON

Download Yara Rule

Strings

2OWqJZldB3s=, xrefs: 00000001400707D1
port, xrefs: 000000014007135F
rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=, xrefs: 0000000140070749

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: 2OWqJZldB3s=$port$rXwr2/Mp0kvTmn+hdCWeFmDWltFpcKXkn/UOvH+3cNE=
API String ID: 0-1454942929
Opcode ID: 1065e8d0ee9d3b13a44241aec8427c35599ae581f942a7ef67f31200059e3b1f
Instruction ID: a3d859d16d8325973c10661ad618f0210053299145ddcdfd328b26100e205a32
Opcode Fuzzy Hash: 1065e8d0ee9d3b13a44241aec8427c35599ae581f942a7ef67f31200059e3b1f
Instruction Fuzzy Hash: B1725F72629BC485E661CB26E4403DAB3A4F7D9784F505316EBCD13BA9EF38C195CB04

Function 0000000140036130 Relevance: 3.9, Strings: 2, Instructions: 1357COMMON

Download Yara Rule

Strings

exists, xrefs: 0000000140037701
Software, xrefs: 00000001400365AD, 000000014003677B

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 578ae4ccc995a136451f604d93af071f0c765f13489324fc5f464d3885e6d86e
Instruction ID: 28be1766aa20d503d1d767cf1f8b32bf6039996a3715809a7116e46607de2276
Opcode Fuzzy Hash: 578ae4ccc995a136451f604d93af071f0c765f13489324fc5f464d3885e6d86e
Instruction Fuzzy Hash: 0AD25D72A10BC48AEB228F7AD8403DE63A0F79D798F105216EB9D57BA9DF74C581C340

Function 00000001400486D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140048843

Strings

vector<bool> too long, xrefs: 00000001400486D4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: vector<bool> too long
API String ID: 118556049-842332957
Opcode ID: 480ce8ef24abe21b7eb60846a31ecc9542ed4649fab68e73c9c70b8ba08d1b42
Instruction ID: 61e65e13e69fc43ad40f22c7197a07162a21ed4251ea8bf3e913d489e5c4e1f9
Opcode Fuzzy Hash: 480ce8ef24abe21b7eb60846a31ecc9542ed4649fab68e73c9c70b8ba08d1b42
Instruction Fuzzy Hash: 62C18932A14B8089EB21CF66D8403ED6360F399BD8F155626EF9C27BA9EB74D591C700

Function 000000014004E130 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014004E314

Strings

conditional not closed, xrefs: 000000014004E2CE, 000000014004E2F1

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: conditional not closed
API String ID: 118556049-2481790218
Opcode ID: d7e0244399ac7a8c38ea61a957ad12611169f52f7b4399fa912360db9583ce19
Instruction ID: f61f111c253a821cdff31c41d955cc0a28299ebbd23709346a6101b3d68f3d52
Opcode Fuzzy Hash: d7e0244399ac7a8c38ea61a957ad12611169f52f7b4399fa912360db9583ce19
Instruction Fuzzy Hash: 19D17072605BC485EB62CF22E9403ED77A5F75D7C8F554226EB890BBA9DB78C690C300

Function 000000014009C1A8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009C21C

Strings

GetLocaleInfoEx, xrefs: 000000014009C1C4, 000000014009C1D5

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction ID: 60772653225e43ecb605bd3172af7641be404793e2a22508e73316e49db17a4f
Opcode Fuzzy Hash: 0fc81d44bec917c2802c26d4724ac6a513cb7d03bb6cf24fcfbb40603345bdc0
Instruction Fuzzy Hash: 7E016271704A8086E7059B57B4407DEA760EB9DBD0F584426FF4913BB9CE3CC5428740

Function 0000000140076760 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000001400767C3
ShellExecuteW.SHELL32 ref: 0000000140076E0A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 91602a81c8f62de41fc0bb930770fc7bd409e86215165c215da3a63e53f2daaf
Instruction ID: d8ee42ea1a97b23c07e2054ee784d732b75578541ab312a8fe866e8dd7ea17d2
Opcode Fuzzy Hash: 91602a81c8f62de41fc0bb930770fc7bd409e86215165c215da3a63e53f2daaf
Instruction Fuzzy Hash: 01121972625F848AEB418F69E88079EB3A4F788798F505215FFDD57B68EB38D190C700

Function 000000014009F7F4 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000014009FA43
RaiseException.KERNEL32 ref: 000000014009FA54

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction ID: 919453debe393908ced8d172903d6ff7188dc84b86e7c64348104e548fea3f73
Opcode Fuzzy Hash: 57a16f90b848e9bfce21c4af82cc5806e79d9fd20c8b8e6b755f3e4c735a4a33
Instruction Fuzzy Hash: 68B12E77610B848BE756CF2AC8463AD7BA0F348B88F158915EB9D877B4CB39C451D701

Function 00007FF73F729028 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF73F729277
RaiseException.KERNEL32 ref: 00007FF73F729288

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 16089e8a79f3e867c82da085aab726f07dd3f88bbbf6223f5e1fcc83706dddd1
Instruction ID: 3efab19fd96942034d70ed2b45d1768e65d3105e568b2c05871e1a4b47fe1465
Opcode Fuzzy Hash: 16089e8a79f3e867c82da085aab726f07dd3f88bbbf6223f5e1fcc83706dddd1
Instruction Fuzzy Hash: 1DB17F77600B899BE719CF29C8853A877F0F748B88F588925DB5D837A4CB39E451D710

Function 0000000140080500 Relevance: 3.2, APIs: 2, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 0000000140080617
EnumDisplayDevicesW.USER32 ref: 00000001400806BB

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: DevicesDisplayEnum
String ID:
API String ID: 2211661463-0
Opcode ID: 2b8b428b17e50488dcb0f7508568a54b23ee9546e4c0b4db8270795c0fdec0a8
Instruction ID: 19c7139242929449c4d4c4b87db3b2f232012005095485b94cee5487fd6aff28
Opcode Fuzzy Hash: 2b8b428b17e50488dcb0f7508568a54b23ee9546e4c0b4db8270795c0fdec0a8
Instruction Fuzzy Hash: 1281B933A14B8486E761CB22E84479E77A4F388798F505225EF9C17BA9DF78D291CB00

Function 0000000140035EE0 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140035F6D
LocalFree.KERNEL32 ref: 0000000140035FFF

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: e83c11dec8a52c273d5158a65c8e10aa182b1c90293aa03496142179bc238d44
Instruction ID: 9e8f040241498dcf4d5bb1e335b6897edc659cddbd66c8fa246a9ca2a154ff2f
Opcode Fuzzy Hash: e83c11dec8a52c273d5158a65c8e10aa182b1c90293aa03496142179bc238d44
Instruction Fuzzy Hash: 16616932B10B809AF712DFB5E4413DE77A1E75878CF048225EB8917AAADB78C5A4D340

Function 00000001400721C0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 0000000140072218
LocalFree.KERNEL32 ref: 00000001400722AA

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction ID: 07660ed2e832bc3cae1564f7fa5c8dbcf9799d612d8db6e1a4bffde423264a9b
Opcode Fuzzy Hash: 6da8b2380d1e6afdbe15ad09ed0a82a6e20629f9e1f2d0947d1afcdde56a6e99
Instruction Fuzzy Hash: C2414232614B80DAE3218F75E4403ED37A4F79878CF084229BB8807E9ADB79C6A5C754

Function 00000001400728C0 Relevance: 3.0, Strings: 2, Instructions: 529COMMON

Download Yara Rule

Strings

+, xrefs: 0000000140072F3F
%, xrefs: 0000000140072F24

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: %$+
API String ID: 0-2626897407
Opcode ID: 775d02d70bd61bf60929dd4d0ac51ebeac3a7b73e8056140f6b91f10b80afd83
Instruction ID: 0a8ec977388b622f50a70cbcb7b4272b44195d339a8611528508db7e15a04db2
Opcode Fuzzy Hash: 775d02d70bd61bf60929dd4d0ac51ebeac3a7b73e8056140f6b91f10b80afd83
Instruction Fuzzy Hash: DF22F232714A848AFB26CB66E4503ED67A1E7597D8F444226EF491BBE9DB3CC485C340

Function 00000001400A29F4 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00000001400A2CA3
a/p, xrefs: 00000001400A2D0E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 84aeccd4d3097aa3e4106772785546d072a9ec9c45404e341c4189bc1fea45af
Instruction ID: 389fbfe1557313ed34f230b6718cffe82f081497b7082f91035d3b4547c0b750
Opcode Fuzzy Hash: 84aeccd4d3097aa3e4106772785546d072a9ec9c45404e341c4189bc1fea45af
Instruction Fuzzy Hash: E0E1AC3270424086EB6ADF2A95547ED23A1FB797C4F558322FB0A47AE4DB38C9D1DB00

Function 000000014002FEE0 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

emoji, xrefs: 000000014002FF50
dumps, xrefs: 000000014002FF28

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: dumps$emoji
API String ID: 0-2873254224
Opcode ID: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction ID: 16a966c1e6dc8a75da5fec909bf11861ce83cbd3804195759c473be833db9215
Opcode Fuzzy Hash: f7c1d0fb9677e435d25e24cad687abe55fd77fc57aacf0daad7dd5b9b370ae1b
Instruction Fuzzy Hash: 81B10932929BC886D761CB26E88179AB7A4F79D784F545315FBCD13B59EB38C290CB00

Function 00000001400555B0 Relevance: 2.0, APIs: 1, Instructions: 455COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014005562B

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4d5c391330686f2bf49f9cfbe987d8adeb6d73f7f4667b30d5a3bcd523a1dd06
Instruction ID: 07ff841972f4859cfb3c331632cf9f1651e54e97bc8d744083198f1847ac1cb1
Opcode Fuzzy Hash: 4d5c391330686f2bf49f9cfbe987d8adeb6d73f7f4667b30d5a3bcd523a1dd06
Instruction Fuzzy Hash: D8028872711B8485EB11DBA2E0543EE63B1E348BD8F448612EF9C17BA9EF35C595C380

Function 000000014006CF70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006D28B

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c06b593c725dc07872aa154df743db2783a7f6756c4fde3946b93bd7402ecb75
Instruction ID: 14a07b967faba2495f95876cee6859b88b251465bb270adb094911aea4f91af1
Opcode Fuzzy Hash: c06b593c725dc07872aa154df743db2783a7f6756c4fde3946b93bd7402ecb75
Instruction Fuzzy Hash: E1A19B32B11B9889EB01CB6AD8903EC37B1F359788F644816EF8D57B69DB38C095C350

Function 000000014006C930 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006CC44

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f00762eceee1fdbe069b05ad4d53d399861816b59c8adad253d3f5e0714af0d5
Instruction ID: dd3bab6621994a701314441ebc57f5e31fbbfe2868830d1758e33f15d639154b
Opcode Fuzzy Hash: f00762eceee1fdbe069b05ad4d53d399861816b59c8adad253d3f5e0714af0d5
Instruction Fuzzy Hash: B8A18C32715B9889EB01CBAAD8803EC7771F359B88F648816EF8D53B65DB38C191C350

Function 000000014006CC50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006CF64

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 50a55a3ba420cf9c46d51042fa6837dcd9d920783ad03091e359f59e14185712
Instruction ID: 905b50fdf4e2d9dafa4c8cd5a0b079d42b41cf8199f5cebde9984da35bd73fe2
Opcode Fuzzy Hash: 50a55a3ba420cf9c46d51042fa6837dcd9d920783ad03091e359f59e14185712
Instruction Fuzzy Hash: DFA18D32725B9889EB01CB6AD8803EC77B1F359B88F644826EF8D57B65DB38C195C350

Function 000000014006C600 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006C929

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f77224b4a8fa35b9d78d45c826c3399db25f702fe04158d418ed51350959cbf1
Instruction ID: 5466a8df070760fce31f30708c42200c4e7f0de2470285a5167c48058d4aae7b
Opcode Fuzzy Hash: f77224b4a8fa35b9d78d45c826c3399db25f702fe04158d418ed51350959cbf1
Instruction Fuzzy Hash: 8BA18932B25B9889EB11CBAAD8807EC77B1F359B88F644516EF8D57B65DB38C095C300

Function 000000014006C300 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006C5F8

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 5510556c1010a6b5d9d490fa0fdf4b9eb31bde02135fd0d777d8d99617ec394c
Instruction ID: b4a6a48b7b4e050dafe35e1efa87def716fca71769d0e53fd640bbf652c55f37
Opcode Fuzzy Hash: 5510556c1010a6b5d9d490fa0fdf4b9eb31bde02135fd0d777d8d99617ec394c
Instruction Fuzzy Hash: 6DA19D72721B9889EB11CB6AD8803EC77B1F359788F648816EF8E57B65DB38D190C350

Function 000000014006D2A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014006D598

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7b2aa9d5b68e4baef185b3c85445150f1967f249de06819966022115a2a2ec44
Instruction ID: 295257dd697b7c105f498c469163df65e835385e9ddaf58949bb6541f3a3edca
Opcode Fuzzy Hash: 7b2aa9d5b68e4baef185b3c85445150f1967f249de06819966022115a2a2ec44
Instruction Fuzzy Hash: A4A18C32B01B9889EB01CB6AD8803EC37B1F359B88F644816EF8D57B65DB38D591C350

Function 00000001400A7270 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400981FC: GetLastError.KERNEL32 ref: 000000014009820B
Part of subcall function 00000001400981FC: FlsGetValue.KERNEL32 ref: 0000000140098220
Part of subcall function 00000001400981FC: SetLastError.KERNEL32 ref: 00000001400982AB

EnumSystemLocalesW.KERNEL32 ref: 00000001400A730E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction ID: 3f0976dd2273b61df12df39fa004812411145b84e83f8b154e4c7763893b7dbc
Opcode Fuzzy Hash: 58800bb6c4d0d9c609f2f6f306793987a7a581936cd52f064e9451565f60872b
Instruction Fuzzy Hash: F011E473A046448AEB268F27D440BDC7BA0F364FE0F448215EB69433E4CA74C6D1CB40

Function 0000000140059A10 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

., xrefs: 0000000140059D10

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 2c3158a9e9f93a969c2a666a1f9b5d2ec7ab747aeecbc16c19022b1ce8de7816
Instruction ID: 40819633d232c9ce66d6ddcfb851f73d9ff1d85534e7ac04d1ad7f72ff7e9d99
Opcode Fuzzy Hash: 2c3158a9e9f93a969c2a666a1f9b5d2ec7ab747aeecbc16c19022b1ce8de7816
Instruction Fuzzy Hash: 78C15D32200B8586EB62DF2BD5843E963A1F78D7D4F554212FB9943BA9DF7AC881C740

Function 00000001400A7340 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400981FC: GetLastError.KERNEL32 ref: 000000014009820B
Part of subcall function 00000001400981FC: FlsGetValue.KERNEL32 ref: 0000000140098220
Part of subcall function 00000001400981FC: SetLastError.KERNEL32 ref: 00000001400982AB

EnumSystemLocalesW.KERNEL32 ref: 00000001400A73BE

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction ID: 7bafb4245b4d6e6c49a7039ce1a260dab7ff05426a5d8df10d52709872900359
Opcode Fuzzy Hash: fd6ab9fb082eedb8b2c8f5dae22463227a7604b7e6560a2cecb061507bc0ecca
Instruction Fuzzy Hash: 9E01D473B0428086EB124F17E840BDD76E1E768BE4F46C321EB69472E5DB7585C19B00

Function 0000000140080110 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000000140080155

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction ID: 75203e3dd4f3446b24b524f80e4a0863d0743b465ce5161dc7d8d01dbbe675d1
Opcode Fuzzy Hash: 5706546f313706de72a237bf98d2ae5729b4666c4094d2ca0903643dc08702f3
Instruction Fuzzy Hash: B801213251878082EB61CF26E8513DAB3A4F79D7C8F544226BB8D47669DBBCC194CB40

Function 000000014009BC68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000014009BCB7

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction ID: 2ca7fd1f05b54c963b0f9f1873e639ef9e3b6397ab2a8ea23eb847ac3e523e9b
Opcode Fuzzy Hash: f8325550294e071d185dd7c07cc84b153cedbfbab89d167ada8b5b9da10e3d51
Instruction Fuzzy Hash: F3F037B2300A4482E705DB2AF8903D97362F79DBD0F549029EB8983375CE3CC961C344

Function 0000000140096718 Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014009672C

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 75fbddce294d53850cb8720f3d0c995c641d577ea31d2d54e246c1f818b064cd
Instruction ID: c7cea57233372fb9159a36606d1a044877f3cf972546b1b200f72c322394f39e
Opcode Fuzzy Hash: 75fbddce294d53850cb8720f3d0c995c641d577ea31d2d54e246c1f818b064cd
Instruction Fuzzy Hash: 3FF0A7F5B2968843EE15876AA5143949292AF5CBF4F049321BE3D4F7D9FA2CC5518700

Function 0000000140080820 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

cores, xrefs: 0000000140080A7E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 019590ad0115f10e951c560004b76864ab1ec08fd4aca4a6271a35c849fb04af
Instruction ID: 48d1548ce1e6ebc5c2a27cab5b9e345949e07f61dba3ac79fc42b0b1d037f52b
Opcode Fuzzy Hash: 019590ad0115f10e951c560004b76864ab1ec08fd4aca4a6271a35c849fb04af
Instruction Fuzzy Hash: D3C1AC73E14B808AF712CB79D4413ED7761F7997A8F105315EB9827AAADB78C285C340

Function 00000001400422D0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0000000140042359

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 1eee20377743313037e87dfd3250b9e477803adeff44f7471b4d9c7a36738e30
Instruction ID: 925d489703091ca12576b7202d7096703c3c39e77b84180031faccdb0c752408
Opcode Fuzzy Hash: 1eee20377743313037e87dfd3250b9e477803adeff44f7471b4d9c7a36738e30
Instruction Fuzzy Hash: 6741E2736196E04AD702CB3A84113BD7FB1E36AB88F5D8162EBD487756CA3DC216D710

Function 00000001400283D0 Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction ID: 6fd620c9e0f5bedb9f15f85c158c24cad8e7168b1e25cee419643e3ff8d0de5b
Opcode Fuzzy Hash: b9b8fdb5bbf29e83ba46770476c642bc1a2f153b56793c0f77b40a01b05bd800
Instruction Fuzzy Hash: A9A2A536615FC88AD7418FAAEC8129D73BAF7487A8B101629EFCC57F19EBB4C1548740

Function 0000000140025520 Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1804191905474db3806b1d037f893adb2ed77d66bc4beb4581f85d947f7d520
Instruction ID: e41204705a852172ae2b054ded55e2618ca728897cf866b669b185b485851132
Opcode Fuzzy Hash: c1804191905474db3806b1d037f893adb2ed77d66bc4beb4581f85d947f7d520
Instruction Fuzzy Hash: 1192A432915BC88AD7718F25E8813DAB7A8F79D788F505315EACC26B19EB78C394C704

Function 000000014003CF60 Relevance: .7, Instructions: 715COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2092706473517ea0c366690d6f38e16538b21e80869a88610edc27ebe7c2e44b
Instruction ID: c63deb447e546a620d84dd5bda6f133db35409457661ed0a61920c8a1f25ac83
Opcode Fuzzy Hash: 2092706473517ea0c366690d6f38e16538b21e80869a88610edc27ebe7c2e44b
Instruction Fuzzy Hash: 4D723B72615BC489EB22CB6AE8413DE73A1F78D798F505316EB9C57BA9DB78C240C700

Function 00007FF73F6F5066 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786666a9a54f52a190c473ee7ae8493f2f49a3a75754473c15ce5d98129577dd
Instruction ID: acf2239ea0ec55d5e7ff13cb3d72bbfc6c9514b8f3c0d92eef2f481707e631ec
Opcode Fuzzy Hash: 786666a9a54f52a190c473ee7ae8493f2f49a3a75754473c15ce5d98129577dd
Instruction Fuzzy Hash: 8DE10633A297E1DAE75D8A29C8103BD6BA6F780788F448035DE5E87794CE3DE901DB10

Function 00007FF73F6F50F7 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b9b08f864ebc6cba58c8e1870d8bcf31582010cfed26ac9fcba16b337000063
Instruction ID: a30c3c3fa6279da49d714de95ea3403fcd0cc7c81922ca9a439c8d5ef493e41d
Opcode Fuzzy Hash: 2b9b08f864ebc6cba58c8e1870d8bcf31582010cfed26ac9fcba16b337000063
Instruction Fuzzy Hash: 9FE11773A296D1DAF75D8A28C8113BD6BA6F740788F488035DE5E87784CE3DE941D710

Function 00000001400566A0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction ID: dafb699e495c2d652fdf687402d44136577feb28b99791e9de0fcf84d8cf050a
Opcode Fuzzy Hash: ff8ff783da37649173626c7f7158936b22345755ff077d27462f74136c1878ba
Instruction Fuzzy Hash: 4AC126737246A487EB56CF66D9447A9B762F3D8BD0F45C120EF4A17B98DA39C806CB00

Function 0000000140006610 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580023e57457b16ea408328f40b5758b718534400140a22a5eb7bf246391415f
Instruction ID: f932bca1567ff62eeda4dcee26db571784017181178d686ac3c3edb1d849f5a3
Opcode Fuzzy Hash: 580023e57457b16ea408328f40b5758b718534400140a22a5eb7bf246391415f
Instruction Fuzzy Hash: 8912D532619FC88AE7718F29E84139AB3A4F78D788F505315EACC57B59EB38C254CB04

Function 000000014002F1C0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b9bb14f3e6f81c4ca495dde812bac6ba233e40ca319bd20837c8fef78df23bb
Instruction ID: e07ed76bf420f18a3300aa9c3de6e5b31a1f1c5e762ac490d9d2e64e7d0a15f4
Opcode Fuzzy Hash: 5b9bb14f3e6f81c4ca495dde812bac6ba233e40ca319bd20837c8fef78df23bb
Instruction Fuzzy Hash: FAF13D72A14F848AEB218B6AE44139D77A0F78C7A8F104315FFDC57BA9EB78C5908700

Function 000000014002F8B0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079b1f84be3b535fe92e849f67de76fb46ce780e6d9d242d08bacea83d607d2a
Instruction ID: 614a0e38fa03bb51f17c49afeebedabe0e1bc579e2cfbe1b67cf751655d23a82
Opcode Fuzzy Hash: 079b1f84be3b535fe92e849f67de76fb46ce780e6d9d242d08bacea83d607d2a
Instruction Fuzzy Hash: 6DF13D32614F888AEB618B6AE44139D77A5F78C7A8F104315FFDC57BA9EB78C1908700

Function 000000014006FDB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655795ea1ab5a198988e0e408986396b56164b6074d6943c6ab19582f79ef5f0
Instruction ID: 2b51c44eea14fc37d7107aa0c263fd063001c5382bdfa568941b80e1dab965f9
Opcode Fuzzy Hash: 655795ea1ab5a198988e0e408986396b56164b6074d6943c6ab19582f79ef5f0
Instruction Fuzzy Hash: D5C1C3B3A146948BE355CF2DD401A5D7BA0F398B84F40A629EF56C3B01E778D9A5CF80

Function 0000000140026510 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction ID: 244b888381bb05f69ebf8f4e9bd995f9f910602567c472218c583180e57d9a4c
Opcode Fuzzy Hash: 58385eaf4bb05c4dd650fe9c3293d5d132ea8d53e59e9018c70652c9bfdaf018
Instruction Fuzzy Hash: 5002D532915BC489D7228F79E8413D977A4F7AD788F105215EACC2BB69EBB4C294C700

Function 0000000140098C34 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 322595ec12f5de06c83f20879fba4a9b345772d0caa38136a1763f2217a78fe8
Instruction ID: b5ce25ed971178a8560dd956dd38226f245c9be8c7f91d869d0a31216916f6ec
Opcode Fuzzy Hash: 322595ec12f5de06c83f20879fba4a9b345772d0caa38136a1763f2217a78fe8
Instruction Fuzzy Hash: F5C1C37630068085EB729B6798107EA27A5F79CBC8F405126FF9987BE9DB39C545CB00

Function 00000001400958D0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction ID: 465f10b081ef39a0b0b1c53d0cacc2ad0859e40d3fe0f7fe3d6722f3564e7983
Opcode Fuzzy Hash: 29683b013f8ac11bc27aba6a7a5ac6f6d500d56baa688bda10aee56a2ac3d60c
Instruction Fuzzy Hash: 51C1ED72600A448AEB2AEF2BD5907AD3BA0F74DBD9F244215EF09477E5DB35C845C740

Function 0000000140095044 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction ID: 433a43793d0fd8ab36007aa4d7fe533c1ff53295d67e0e1ac9a18f63f2ac8bad
Opcode Fuzzy Hash: 961d3e7eb4dbe1c42d41fae25b585760f3c2351026af9e0dc6bb8535c2ebc898
Instruction Fuzzy Hash: DEB14972114B8486EB669F3BD0903AC3FB4E34EBC9F284116EB8A477A5DB76C541C741

Function 0000000140097060 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 785bb13fe01c7cf8ebae0a68e8c88eb6843a3380ff6b94b7bcfacfe4a0d1ed08
Instruction ID: 6e5082cd8b268532cbb99ed60f7a63936767c33c1d27f6c0316509795a6a3248
Opcode Fuzzy Hash: 785bb13fe01c7cf8ebae0a68e8c88eb6843a3380ff6b94b7bcfacfe4a0d1ed08
Instruction Fuzzy Hash: C681AF73210A5486EB66CF6AC4917AD23A0F788BE8F148616FF6E977A5DF34C041C300

Function 0000000140006D20 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction ID: 9780cdb29e3349499c479d8be2a81b7db5d3ca83ef343859d757ae583d6a04ef
Opcode Fuzzy Hash: 4e8cb9989ebccae2b4934454dacc3e473b3a3bc5e9d1377eb956669a5a9cd281
Instruction Fuzzy Hash: 47B1F532915FC88AD7118FB9E840299B7B5F7997A8F145315EB8C23F69EB74C154C700

Function 00000001400BE2CC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4f2b32ed55bdf8b9409e071c7d5cdb246953037830da7258260c434281152d86
Instruction ID: 62c3ae1a8ba796245f779a7eafcc6816095e680672ad2dd835c437fa63b3ffdc
Opcode Fuzzy Hash: 4f2b32ed55bdf8b9409e071c7d5cdb246953037830da7258260c434281152d86
Instruction Fuzzy Hash: D1610532714ED042F77A8EAB84447ED66E0A7487F4F184629FB268BBE5E779C8008701

Function 00000001400701F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction ID: 83fa40dff9d8fddf4d6748226ff835bf0cb44efe09f0f7ba020bf552d73a8b03
Opcode Fuzzy Hash: 8564914535ee6488183395aa034df85c3b96b43cc627a35cfc23d0d483c1855f
Instruction Fuzzy Hash: F361DD2321E2C48BD30EDF7C589106D7F61D3A7908788469DEA85EBB4BC514C91ACBA6

Function 0000000140078230 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction ID: 9a4fdff203fbe54daeaddf10faee8f19fa0e998406d0747606889806d72ffd80
Opcode Fuzzy Hash: 08e682c8f50e6a31ebca66eccf7bc014078cfb37ed238d168109819e35b8cd79
Instruction Fuzzy Hash: 1151E4A3B0568443DB248B49F842B96F7A5FB987C5F00A126EE8D57B68EB3CD5818700

Function 00000001400945F8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: bda84b1824013184e901044c9162f89eb6971486f0d8fdd93b231d5c991db21e
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: F151B176224A5486EB268F2AC040BA977A1E74EFECF288111EF48577B4D736DC53C780

Function 00000001400947FC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: 56bc9dfee9c9d62c56348c85dc09ea7561f76258268a6931bf9dbce5217b3057
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: 84518036614A9086EB268F2AC050BAE37A0E34DFD8F248115EF89577B5CB36DC53C780

Function 0000000140094A00 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: a34930b951578ab82af46aba38902a78245f96a6eb1497d8605a08631e040099
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 36518C36610A6086E7368B2AC050BAD37A1E38DFD8F294111EF49577B9DB36DC53C784

Function 00007FF73F718108 Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction ID: 8d38e868b1c21ba05c995b2914017910481c4a7e1d1babdce588d5eff0694ca7
Opcode Fuzzy Hash: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction Fuzzy Hash: 5851D63BA14E9196F7299B28D1442B873A0EB49B98FE44135CE4C17794CB3EF846E750

Function 00000001400A9EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8fbae818eea1d914da60437b7a5c964747a04bdd4ff824fbc22ee65c1649dd6a
Instruction ID: 622d658bb579463342a60eb88acdba3291ff192c6105db1b9149c96326d0f966
Opcode Fuzzy Hash: 8fbae818eea1d914da60437b7a5c964747a04bdd4ff824fbc22ee65c1649dd6a
Instruction Fuzzy Hash: 5741BE72310A5486EF04CF6BD9147A9B3A1B35CFD0F599126EF0D97BA8DA7DC0828700

Function 00000001400D2008 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction ID: 2ac5b8604f8082e3b301dca745a97aeb38b0fb8bcd962e4c35fbf8d2e483cc53
Opcode Fuzzy Hash: 65fcb47a17adf94f373ff647ddafb07328eb1c747429ddd71517b78256354565
Instruction Fuzzy Hash: BBF0CDBBA1D7D05AF35356250C7E3CC2FA19BBABA2F8D804AAB40835E394560C07D261

Function 00000001400D22D8 Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction ID: a97666989a6c50524937c3b4f7cf11007b280822b607ed7aeea63bb8bdf8f352
Opcode Fuzzy Hash: d53a79903260b7a4f0e6c71e7ffc168a0f2adb2b336afcda935cdf6e025e0c2f
Instruction Fuzzy Hash: 95F030B7A5FFD006F3A395260E7A39C2ED29BB9745F1E404AAB44031D3F4151C055231

Function 00000001400D2398 Relevance: .0, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2210f077ef86c7bf4614ea0c37c8164b564742ed14eb5f7aa46d453aca7d6b85
Instruction ID: 2104ec59a4dc49f82b8982bc21a3bd57277665e00a15ef369f3c2076de0706b5
Opcode Fuzzy Hash: 2210f077ef86c7bf4614ea0c37c8164b564742ed14eb5f7aa46d453aca7d6b85
Instruction Fuzzy Hash: 89E04FA7A4DBC019F31742610C3F74C1ED15B7AB11F4D809F9784036E3B45D6D018321

Function 00000001400D22C8 Relevance: .0, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf1b8df624b78c9f13672db90697f33a184046833f8e29593a1d8da03b41296a
Instruction ID: 3e52525d39e57bbbd7167a3d2a5026f39e520ea7036a62e7442895414421d68b
Opcode Fuzzy Hash: bf1b8df624b78c9f13672db90697f33a184046833f8e29593a1d8da03b41296a
Instruction Fuzzy Hash: 7DA002DBE99384ABCB1609700CE14E91F1679B2900395505EE351D33D3BC8D0A0B9522

Function 00000001400D26E0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction ID: fc375e107b753bca87d2e5f25e52953cf1a968f4214fa0c85e8a076f85c030cc
Opcode Fuzzy Hash: a42a01495bc10c92585e70db87d9dd7e84e2cd6d90333ee8a624f4433841b9f2
Instruction Fuzzy Hash: 10A01277308190C6F1030A1004093882750DB62740F89C040960003403C025040E8A10

Function 00000001400D2090 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction ID: af3653673c9bae8fed5e00a7e40e93a6d893659c824e5b6b97dfa18919de230f
Opcode Fuzzy Hash: f01a4154ba30de378ee8f3a0bf3b2dfb59d47392f9fc814d815bb3a6ccc76d7c
Instruction Fuzzy Hash:

Function 000000014006ED30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014006ED86
Process32FirstW.KERNEL32 ref: 000000014006EDCA
Process32NextW.KERNEL32 ref: 000000014006EDDF
OpenProcess.KERNEL32 ref: 000000014006EE1B
OpenProcessToken.ADVAPI32 ref: 000000014006EE42
GetTokenInformation.ADVAPI32 ref: 000000014006EE6E
GetLastError.KERNEL32 ref: 000000014006EE7C
GetTokenInformation.ADVAPI32 ref: 000000014006EEBC
ConvertSidToStringSidA.ADVAPI32 ref: 000000014006EED3
CloseHandle.KERNEL32 ref: 000000014006EF46
CloseHandle.KERNEL32 ref: 000000014006EF51
CloseHandle.KERNEL32 ref: 000000014006EFB6
Process32NextW.KERNEL32 ref: 000000014006EFC3
CloseHandle.KERNEL32 ref: 000000014006EFE9
CloseHandle.KERNEL32 ref: 000000014006EFF2
CloseHandle.KERNEL32 ref: 000000014006F007

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: c152bcc0f857d81ff5647e8ddb4c180c87544070a640b5307595c1d27c25ffce
Instruction ID: e76f1ebeb704c98237b583daf9801828aa5510d0b409167e4f846fc11401e4ad
Opcode Fuzzy Hash: c152bcc0f857d81ff5647e8ddb4c180c87544070a640b5307595c1d27c25ffce
Instruction Fuzzy Hash: 7E813736214B8082FB52CB66E8443AEA7A6FB98BD4F504125FF8947BA8DF78C545C700

Function 00000001400981FC Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000014009820B
FlsGetValue.KERNEL32 ref: 0000000140098220
FlsSetValue.KERNEL32 ref: 0000000140098241
FlsSetValue.KERNEL32 ref: 000000014009826E
FlsSetValue.KERNEL32 ref: 000000014009827F
FlsSetValue.KERNEL32 ref: 0000000140098290
SetLastError.KERNEL32 ref: 00000001400982AB
FlsGetValue.KERNEL32 ref: 00000001400982E1
FlsSetValue.KERNEL32 ref: 0000000140098300

Part of subcall function 000000014009BBB8: HeapAlloc.KERNEL32 ref: 000000014009BC0D

FlsSetValue.KERNEL32 ref: 0000000140098328

Part of subcall function 000000014009B550: HeapFree.KERNEL32 ref: 000000014009B566
Part of subcall function 000000014009B550: GetLastError.KERNEL32 ref: 000000014009B570

FlsSetValue.KERNEL32 ref: 0000000140098339
FlsSetValue.KERNEL32 ref: 000000014009834A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 039c9e09f7b0b479bda9def718700e7d12b289cc769761084de473972523203a
Instruction ID: a80ce912e97d4204afe66bda0cdaff3348733f0b0512e2f52126cd6cd2ed238e
Opcode Fuzzy Hash: 039c9e09f7b0b479bda9def718700e7d12b289cc769761084de473972523203a
Instruction Fuzzy Hash: F5413E7060460082F97B637795527ED22925B8DBF0F588B28BF36577F6EE39D4114701

Function 0000000140074C60 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140074CDD
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140074D25
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140074EA1
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140074EB4
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140074EBA

Strings

bad locale name, xrefs: 0000000140074EA7
false, xrefs: 0000000140074DAD
true, xrefs: 0000000140074DDC

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: ac14ec4081e7218eb524f80c83b8b839b3b5ebd962557539344c6cba77ef8f3b
Instruction ID: b6042c49e0fdf50d421250a2f9291c072cfad1849c90b21f6164cabc77790bcf
Opcode Fuzzy Hash: ac14ec4081e7218eb524f80c83b8b839b3b5ebd962557539344c6cba77ef8f3b
Instruction Fuzzy Hash: C2712C32702B408AFB16DFB6D4503EC73B5FB98B98F044125AB4927BAADB38C511D345

Function 00007FF73F6DC070 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 199COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6DC381
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF73F6DC387

Strings

]: , xrefs: 00007FF73F6DC18D
ios_base::eofbit set, xrefs: 00007FF73F6DC031
-> , xrefs: 00007FF73F6DC2BA
ios_base::badbit set, xrefs: 00007FF73F6DC01E
ios_base::failbit set, xrefs: 00007FF73F6DC02A

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: -> $]: $ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3668304517-65459876
Opcode ID: f9529d1262f45794f893172a3fb2218e312ce632347a028db3db72a0b862267f
Instruction ID: 0e121a8dc1a84aca59dad1badefd3aea2c9059c11104273cf964d5067333dba6
Opcode Fuzzy Hash: f9529d1262f45794f893172a3fb2218e312ce632347a028db3db72a0b862267f
Instruction Fuzzy Hash: 9691C033604AD5A5EB18EF29E4803EDA766EB84BC4F809132EA4E477E9CF2CD451D350

Function 000000014009BCE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009BE60
GetProcAddress.KERNEL32 ref: 000000014009BE6C

Strings

ext-ms-, xrefs: 000000014009BDBD
api-ms-, xrefs: 000000014009BDAA

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction ID: 8220be3b321e96a62fa523ccb547e2e55f12d4419ca12e8ad036c7b969c026eb
Opcode Fuzzy Hash: c6120ce6c378417c8061f2daa80316ce8b84504fe2d3d9dfde353b277e126bba
Instruction Fuzzy Hash: E641D231322A0082FA17DB27AA447D923A5BB5DBF0F494229FF19477B4EF38C4468300

Function 00007FF73F72610C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00007FF73F72696C,?,?,?,?,00007FF73F71FD41,?,?,?,?,00007FF73F70C688,?,?,?), ref: 00007FF73F726288
GetProcAddress.KERNEL32(?,?,00007FF73F72696C,?,?,?,?,00007FF73F71FD41,?,?,?,?,00007FF73F70C688,?,?,?), ref: 00007FF73F726294

Strings

api-ms-, xrefs: 00007FF73F7261D2
ext-ms-, xrefs: 00007FF73F7261E5

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: cebf85696f7496ba91beafcd6355927ac5a9610b08450431fdc6bf855b832028
Instruction ID: b6db1146a277ab186ede59c0039424e54ccb7af76909f6aebc4e268a55fd032b
Opcode Fuzzy Hash: cebf85696f7496ba91beafcd6355927ac5a9610b08450431fdc6bf855b832028
Instruction Fuzzy Hash: F841F125B19A8A71EA2DAB16AC045F5A2D1FF49BD0FC84136DD0D87788EF3CF414A360

Function 0000000140075090 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00000001400750FB
InternetOpenUrlA.WININET ref: 0000000140075130
InternetReadFile.WININET ref: 0000000140075151
InternetReadFile.WININET ref: 000000014007518F
InternetCloseHandle.WININET ref: 000000014007519C
InternetCloseHandle.WININET ref: 00000001400751A5

Strings

File Downloader, xrefs: 00000001400750F4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction ID: bfb265ce36db056b15d965d478bcbb8bb938d8e175729399c245ed9ae15a8519
Opcode Fuzzy Hash: d760029ad861ea7f7ea2ffc299629ee0db5f3c755485599aed123bc73a668a15
Instruction Fuzzy Hash: 0B314832214B8086EA229F26E8507DAB7A4FB99BC5F944115FF8943B68DFBCC5558B00

Function 00000001400932AC Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400932EF
_invalid_parameter_noinfo.LIBCMT ref: 00000001400936DC
_invalid_parameter_noinfo.LIBCMT ref: 0000000140093978

Strings

f, xrefs: 0000000140093411
p, xrefs: 0000000140093419
p, xrefs: 00000001400933A1

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction ID: e7fb270209fc59bed852ca4785643875915e0a9791c3c7e783b5d6bf283a1668
Opcode Fuzzy Hash: da133f4d1d1d50a9f8077a7ed93c78c5851a9c9ee1111e96f3e2a2a160aeb47c
Instruction Fuzzy Hash: C712907270824186FB269B57E0547FAB6A2F3887D4F988116F7D247AF4DB78D9808F10

Function 00007FF73F700030 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 00007FF73F7000D3
__swprintf_l.LIBCMT ref: 00007FF73F70012E

Strings

%%%u, xrefs: 00007FF73F7000C7
%s@%u, xrefs: 00007FF73F700202
<Reg-%u>?%u, xrefs: 00007FF73F700228
@%s, xrefs: 00007FF73F700122

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: __swprintf_l
String ID: %%%u$%s@%u$<Reg-%u>?%u$@%s
API String ID: 1488884202-156413795
Opcode ID: 7fd671964039da7dbb8933364dd42fea94609a5ef2f2242c80f7015ed7fd2c49
Instruction ID: 755bd18fa2f742774d5667d1162bcf8503e04f95f0c92db96c33bb1d83bf36d0
Opcode Fuzzy Hash: 7fd671964039da7dbb8933364dd42fea94609a5ef2f2242c80f7015ed7fd2c49
Instruction Fuzzy Hash: 98512539A0C6E292E758A715E8003F8A761AF887E4FD40232DA6C477E9DF2DF581D711

Function 00000001400AABDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400AAC0D
GetLastError.KERNEL32 ref: 00000001400AAC19
CloseHandle.KERNEL32 ref: 00000001400AAC31
CreateFileW.KERNEL32 ref: 00000001400AAC5C
WriteConsoleW.KERNEL32 ref: 00000001400AAC7B

Strings

CONOUT$, xrefs: 00000001400AAC3D

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction ID: 8dadf6f5a56d60ecf8f81703174400bf42c957489f8d82f436bb4056bb13bce1
Opcode Fuzzy Hash: 97ef1f90b5d1e549fd4d93c948d975b58c02b300c1de8e440893a5efab19f807
Instruction Fuzzy Hash: 81116D31314A8086F7518B57E854399B3A0F7ADFE4F144224EF59877A4DF7CC8458740

Function 00000001400BB73C Relevance: 9.2, APIs: 6, Instructions: 239COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400BB7E9
MultiByteToWideChar.KERNEL32 ref: 00000001400BB885
MultiByteToWideChar.KERNEL32 ref: 00000001400BB92E
MultiByteToWideChar.KERNEL32 ref: 00000001400BB958
MultiByteToWideChar.KERNEL32 ref: 00000001400BBA00
CompareStringEx.KERNEL32 ref: 00000001400BBA4D

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: f9110f350b147d39b824703678ab19b38572e061a31005d64d23ccef20f85515
Instruction ID: e05c567637f5436f7b4e5854200c66fa704dbebf4f97f2e885f1cc2981a05130
Opcode Fuzzy Hash: f9110f350b147d39b824703678ab19b38572e061a31005d64d23ccef20f85515
Instruction Fuzzy Hash: B2A1AE72604B808BFB238FA394503ED76A5E758BE8F444621FB5907BE5DBB8CA45C301

Function 00000001400BB3DC Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400BB44C
MultiByteToWideChar.KERNEL32 ref: 00000001400BB4EA
LCMapStringEx.KERNEL32 ref: 00000001400BB553
LCMapStringEx.KERNEL32 ref: 00000001400BB5A5
LCMapStringEx.KERNEL32 ref: 00000001400BB64A
WideCharToMultiByte.KERNEL32 ref: 00000001400BB6A4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: f91b7c4b2395b2fea06cc2c02e2e1cf9136a9b33eadb0f027fb768752b3ac841
Instruction ID: c6cac4dc1e11ae01760347a2ab03accf4a59e7a90a541d43830e36e0be7f87f7
Opcode Fuzzy Hash: f91b7c4b2395b2fea06cc2c02e2e1cf9136a9b33eadb0f027fb768752b3ac841
Instruction Fuzzy Hash: CE81A072200B8087EB228F66E4407A977E5FB98BE8F544625FB5947BE9DB7CC941C700

Function 0000000140098374 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140098383
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000001400940D5,?,?,?,?,000000014009B584), ref: 00000001400983B9
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000001400940D5,?,?,?,?,000000014009B584), ref: 00000001400983E6
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000001400940D5,?,?,?,?,000000014009B584), ref: 00000001400983F7
FlsSetValue.KERNEL32(?,?,-2891666E48DAA7FF,00000001400940D5,?,?,?,?,000000014009B584), ref: 0000000140098408
SetLastError.KERNEL32 ref: 0000000140098423

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 47747b4fce285073a0e2fe22e01b95934fc6c31783b87f6b8fd0ce1873d4bd80
Instruction ID: bbf18a45137da7c412e4799e3a4da64e19dfec212c683a90e58579de2fbf9b7a
Opcode Fuzzy Hash: 47747b4fce285073a0e2fe22e01b95934fc6c31783b87f6b8fd0ce1873d4bd80
Instruction Fuzzy Hash: EC117C3070464082FA6AA7279A527ED62525F8CBF0F448728BF7657BF6DE38D4118700

Function 000000014002DB90 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002DBEF

Part of subcall function 00000001400B9570: AreFileApisANSI.KERNEL32 ref: 00000001400B9582

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DE97
__std_exception_destroy.LIBVCRUNTIME ref: 000000014002DF51

Strings

: ", xrefs: 000000014002DCAA
", ", xrefs: 000000014002DCDD

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 741338541-747220369
Opcode ID: 183de0af4bf5c104e9fd460dc0e40e0f6bffd643279a52128d6833ebb1cca696
Instruction ID: 3b435bcbca237dbda664ba81961a27016b3838a2af38c9f1768d018300258ce4
Opcode Fuzzy Hash: 183de0af4bf5c104e9fd460dc0e40e0f6bffd643279a52128d6833ebb1cca696
Instruction Fuzzy Hash: D0B19C72710A4095EB02EF66E0543ED33A1E758BC8F508526EF5D5BBAADF38C995C380

Function 000000014009F4D8 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000000014009F517
_set_statfp.LIBCMT ref: 000000014009F535
_set_statfp.LIBCMT ref: 000000014009F55E
_set_statfp.LIBCMT ref: 000000014009F79A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction ID: 1710e1716973c1a313206f7d86182a13b7e1a4bcbe22680aceb670f7ee5c9dd1
Opcode Fuzzy Hash: 5459f65f4676636fdc901623b58b7eba5cdeda63d87ce883b5aed9902fe8fe9f
Instruction Fuzzy Hash: 8681C032118E8486F3739F37A5403FEA6A1AB5D7D8F154301BF5A275F5DB38C981A600

Function 000000014009843C Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000014008F8AF,?,?,00000000,000000014008FB4A,?,?,?,?,-2891666E48DAA7FF,000000014008FAD6), ref: 000000014009845B
FlsSetValue.KERNEL32(?,?,?,000000014008F8AF,?,?,00000000,000000014008FB4A,?,?,?,?,-2891666E48DAA7FF,000000014008FAD6), ref: 000000014009847A
FlsSetValue.KERNEL32(?,?,?,000000014008F8AF,?,?,00000000,000000014008FB4A,?,?,?,?,-2891666E48DAA7FF,000000014008FAD6), ref: 00000001400984A2
FlsSetValue.KERNEL32(?,?,?,000000014008F8AF,?,?,00000000,000000014008FB4A,?,?,?,?,-2891666E48DAA7FF,000000014008FAD6), ref: 00000001400984B3
FlsSetValue.KERNEL32(?,?,?,000000014008F8AF,?,?,00000000,000000014008FB4A,?,?,?,?,-2891666E48DAA7FF,000000014008FAD6), ref: 00000001400984C4

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction ID: f2c8a1394976aa572b4b3ea03ccc6eeb0867dee7737c87fc9a5fa4b79e45c8bc
Opcode Fuzzy Hash: 64b21c8772d4c2280a2575dd52794ef6fbd465c186315b0bb9d8ae0d08d06aa7
Instruction Fuzzy Hash: 7D118F7070424142FA7B9327AA527E961415F8C7F4F488729BF7A57BF6EE38D4118700

Function 0000000140046510 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140046580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400465C8
_Getcoll.LIBCPMT ref: 00000001400465FC

Strings

bad locale name, xrefs: 0000000140046701

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 5948856726f2b840d409c5f4b733e0a6895806bfff6a98c357fa50f557e46ac7
Instruction ID: 1e95a86128f9099804978c87e52d00bdd147c21b1a35b1dc1d98c486db94063a
Opcode Fuzzy Hash: 5948856726f2b840d409c5f4b733e0a6895806bfff6a98c357fa50f557e46ac7
Instruction Fuzzy Hash: E8916D32B01B808AFB16DFB6E4503EC3361EB48BC8F054525EB592BBAADE38C551C745

Function 00000001400BD3EC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BD6CB

Part of subcall function 00000001400AA7BC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AA7D9

Strings

ccs, xrefs: 00000001400BD606
UTF-16LEUNICODE, xrefs: 00000001400BD669
UTF-8, xrefs: 00000001400BD64A

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction ID: af4ea66b0387ae81521fdb9ec0db1dba4260a1699b29e9a64e2b7298754a3348
Opcode Fuzzy Hash: c93d0c80d14289c47e4e012ab7823fd63e1d2ef69c6c82be7162492af36b69b4
Instruction Fuzzy Hash: 2C816772A04E0086FB779FAB81903E9BBB0E319BC8F558017FB46972B5E339D8419751

Function 0000000140059E10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059FF0
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140059FFD

Strings

at line , xrefs: 0000000140059E9A
, column , xrefs: 0000000140059EC8

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 40fa3857f4feaa950f825e08dbaba4dddf4bcda4851685c3f32437d1a4db4242
Instruction ID: 42502781d1c54d23748bdc79e97fad415d38dffec936dd6b56aaefe9e0b9ea82
Opcode Fuzzy Hash: 40fa3857f4feaa950f825e08dbaba4dddf4bcda4851685c3f32437d1a4db4242
Instruction Fuzzy Hash: C951AF72A14B8081EA11DF1BE5813AEA761F79DBD0F104611FBA847BAADF39C591C740

Function 000000014002C910 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002C97F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002C9C7
_Getctype.LIBCPMT ref: 000000014002CA05

Strings

bad locale name, xrefs: 000000014002CABE

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 97a67ff78dc1c9865f5140c0fd7da35d8d9f7c34203690876748439388acebb1
Instruction ID: 33dd21c51c2689faa17939b52d89de942c71b20a4f1dfe9de207af66e0059ef0
Opcode Fuzzy Hash: 97a67ff78dc1c9865f5140c0fd7da35d8d9f7c34203690876748439388acebb1
Instruction Fuzzy Hash: 68514836712B809AFB12CFA2D4903EC73B5EB49788F444029EF8927AA6DB34C955D345

Function 0000000140080F00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000000140080F8B

Strings

?, xrefs: 0000000140080F40

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: 7a5dc59477f54229e9283b353c6fb504f914d1809cc60569f6f9725c42af7ce8
Instruction ID: f59193fde31b12f16bc7eaa2e02e19e88690bfbb91d05c554e08d6fa694f4ae9
Opcode Fuzzy Hash: 7a5dc59477f54229e9283b353c6fb504f914d1809cc60569f6f9725c42af7ce8
Instruction Fuzzy Hash: 62419072618B8081EB51CB26F4803AEB7A1FBD97D4F105215FB9943AA9DF7CC194CB40

Function 00000001400B9520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400B9536
GetProcAddress.KERNEL32 ref: 00000001400B9546

Strings

GetTempPath2W, xrefs: 00000001400B953C
kernel32.dll, xrefs: 00000001400B952F

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction ID: 9fc1ad943f3150dd33a16686bf4c96b6565ef5c5b71d091d0fbab70fb06b86ed
Opcode Fuzzy Hash: 54cfff917e61736e637f3daaf4ede8ca0052c6a8694a4254edfc7bf5cdf1c370
Instruction Fuzzy Hash: B5E0E531300A4482EE0AAB12F9843AD2361FB9DBC5F589029EA0E07338DE3CC48B8310

Function 000000014006F480 Relevance: 6.5, APIs: 4, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000000014006ED30: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014006ED86
Part of subcall function 000000014006ED30: Process32FirstW.KERNEL32 ref: 000000014006EDCA
Part of subcall function 000000014006ED30: Process32NextW.KERNEL32 ref: 000000014006EDDF
Part of subcall function 000000014006ED30: OpenProcess.KERNEL32 ref: 000000014006EE1B
Part of subcall function 000000014006ED30: OpenProcessToken.ADVAPI32 ref: 000000014006EE42
Part of subcall function 000000014006ED30: CloseHandle.KERNEL32 ref: 000000014006EFB6
Part of subcall function 000000014006ED30: Process32NextW.KERNEL32 ref: 000000014006EFC3
Part of subcall function 000000014006ED30: CloseHandle.KERNEL32 ref: 000000014006F007

ImpersonateLoggedOnUser.ADVAPI32 ref: 000000014006F4DD
ImpersonateLoggedOnUser.ADVAPI32 ref: 000000014006F9C8
RevertToSelf.ADVAPI32 ref: 000000014006F9E6

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleImpersonateLoggedNextOpenProcessUser$CreateFirstRevertSelfSnapshotTokenToolhelp32
String ID:
API String ID: 1562318730-0
Opcode ID: ffeadf0ee18f2bc84767736d888f0101608cd5a7807fc2781920c5c1b7914a63
Instruction ID: 7d11138bed14001e9a20f972041504370d7828cd5a6dc1a633d7bac69a723ea5
Opcode Fuzzy Hash: ffeadf0ee18f2bc84767736d888f0101608cd5a7807fc2781920c5c1b7914a63
Instruction Fuzzy Hash: 3B22BE72614B8086FB029B7AD8543ED2762E7897E8F605601FB6D47AFADF78C481D700

Function 000000014009A888 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000014009A907
WriteFile.KERNEL32 ref: 000000014009ABCF
WriteFile.KERNEL32 ref: 000000014009AC15
GetLastError.KERNEL32 ref: 000000014009ACCB

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction ID: f3305f2fb35918a2f3c8c79c53fe28da178ee17efa2ad8cf0b2b474e0742e1d1
Opcode Fuzzy Hash: 523722e26ffa46449d979bd975143a43a29be3ae997596a7a20ff96f8c1017ee
Instruction Fuzzy Hash: 31D1C172B14A848AE712CF6AD4403DC37B1F7597D8F058216EF5D9BBA9DA38C406C780

Function 000000014009B248 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000000014009B364
GetLastError.KERNEL32 ref: 000000014009B3EF

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ff0b11da3eb5572d6ecf13898564005a102edae2abd8db21ab52748eeea9148d
Instruction ID: 019394df496d6244afe94088924e8332af31b86073adac6f0fd0889a546c3440
Opcode Fuzzy Hash: ff0b11da3eb5572d6ecf13898564005a102edae2abd8db21ab52748eeea9148d
Instruction Fuzzy Hash: 4291DF72710A5085FB62DF6B95803ED3BA0F759BE8F544109FF4A67AA5CB38C882C700

Function 0000000140084220 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000140084240
FreeEnvironmentStringsW.KERNEL32 ref: 000000014008433B
RtlInitUnicodeString.NTDLL ref: 00000001400843AE
RtlInitUnicodeString.NTDLL ref: 00000001400843BB

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 9ef064dd6b1193a2e317814dba3e2b270db8320ab69c8f3d20a08b5252e84ce4
Instruction ID: 6b9ce6490b8bf096a76cc6edd16765a6a462edb9d1c66785b7c6a6552cbab2ea
Opcode Fuzzy Hash: 9ef064dd6b1193a2e317814dba3e2b270db8320ab69c8f3d20a08b5252e84ce4
Instruction Fuzzy Hash: 12518A33A18B8482EB128F26E54039D7760F798BD4F599215EB9D03BA5DF78D2E1C700

Function 0000000140040120 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400BA8FC: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400BA919
Part of subcall function 00000001400BA8FC: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400BA93C

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140040161
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140040186
std::_Facet_Register.LIBCPMT ref: 0000000140040232
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140040294

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: f70e8215099087a7998588726e142b4002e864ca88b967037f390683ad6cc197
Instruction ID: ee8b44e1a8d000ea85175ec69280d0b0382f3ca686e1c441b6adcf2c9661376a
Opcode Fuzzy Hash: f70e8215099087a7998588726e142b4002e864ca88b967037f390683ad6cc197
Instruction Fuzzy Hash: 2F414632221B4086EA52DF56E8843DA73A4F78CB94F5A1626FB9D137B6DF38C442C704

Function 00000001400740C0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400740EB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140074110
std::_Facet_Register.LIBCPMT ref: 00000001400741BB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140074206

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction ID: 30c30808b820496da014a0f67b9031e768b99412f5953b1f7616555f12768c5c
Opcode Fuzzy Hash: f751cf97cbdb91efc437d10692cdb5900781dee89e6afe037389110580d2090b
Instruction Fuzzy Hash: AF415932211A4081FB16EF56E8403DA6760F39DBE4F581221AB4907BB5DF3CC482C700

Function 0000000140074940 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007496B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140074990
std::_Facet_Register.LIBCPMT ref: 0000000140074A3B
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140074A86

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction ID: 97c136d5f850db9e315c0bebb449880c5f7bf93b077432cd676f4d7cd98b6770
Opcode Fuzzy Hash: 225fe1b72370eebaf99dac6ca4c61f0c7a8ae1283e1f422937767657019483ac
Instruction Fuzzy Hash: B6416732211A4086FB12DF67E4803DA67A0F38DBE4F181226AB9D077B9DF3CC4428710

Function 00000001400539F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140053A1B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140053A40
std::_Facet_Register.LIBCPMT ref: 0000000140053AEB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140053B36

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction ID: 41dfd7b2fb8d84404eb936995949f98a51f3a6e96fcf9b366ac91052ee80f0dd
Opcode Fuzzy Hash: 268a738e79390acd07def2dc4d1be91678e0d7bbd421806bae9408622498fc9b
Instruction Fuzzy Hash: 67414232214A4085FA26DB57E8543EA77A0F38DBE4F981626EB8D477B9DF39C442C700

Function 0000000140041DD0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041DFB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140041E20
std::_Facet_Register.LIBCPMT ref: 0000000140041ECB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140041F16

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction ID: 0f242aeb19428095b3b4ff121d4c6731f4f9a253452f0cd89c72cf864e8b8130
Opcode Fuzzy Hash: deae80201b058b93dee9511eb23f4883bce05ec3d16f28b31309998fe1f492bf
Instruction Fuzzy Hash: 1241583A214A4081FA26DF57E4403DAB7A0F78CBE4F590626BB9D477B9DF38C4428714

Function 00007FF73F6E8090 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73F6EDE33), ref: 00007FF73F6E80C3
VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73F6EDE33), ref: 00007FF73F6E80E0
VirtualAlloc.KERNEL32 ref: 00007FF73F6E812D
GetLastError.KERNEL32 ref: 00007FF73F6E8138

Memory Dump Source

Source File: 00000000.00000002.1768044794.00007FF73F6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73F6D0000, based on PE: true

Associated: 00000000.00000002.1768025799.00007FF73F6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F73B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768087766.00007FF73F75E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768225229.00007FF73F8FE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1768246664.00007FF73F903000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff73f6d0000_chelentano.jbxd

Similarity

API ID: Virtual$AllocErrorInfoLastQuerySystem
String ID:
API String ID: 1049033158-0
Opcode ID: c8704ef1a0a8b5c54b8508df02da92c122e1098ded75d4dee760d4b4c3904de0
Instruction ID: 860cafb43deffea9ea2c55bf26acb8d7fef2e321822f4707db9fbfd599410cf7
Opcode Fuzzy Hash: c8704ef1a0a8b5c54b8508df02da92c122e1098ded75d4dee760d4b4c3904de0
Instruction Fuzzy Hash: 9F210222B18792D2EA189B21E7443F9A326BBA8FC0F985131DA4D07B54DE3DE580D790

Function 00000001400B9704 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400B974D
GetLastError.KERNEL32 ref: 00000001400B975B
WideCharToMultiByte.KERNEL32 ref: 00000001400B9790
GetLastError.KERNEL32 ref: 00000001400B979E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction ID: 9972b83a7486bee005c6b6b5c859c20ef93431e596310c8a9094b598c6582069
Opcode Fuzzy Hash: 885017ec562e008ced87b7a088d7b161d23e12804f5abb955417809e776ebcf4
Instruction Fuzzy Hash: CA213B76628B84C7F3108F22E44435EB6B4F79DBD4F244128EB8957B65DB39C4018B40

Function 00000001400B9BF0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400B9520: GetModuleHandleW.KERNEL32 ref: 00000001400B9536
Part of subcall function 00000001400B9520: GetProcAddress.KERNEL32 ref: 00000001400B9546

GetLastError.KERNEL32 ref: 00000001400B9C14

Part of subcall function 0000000140097BC4: IsProcessorFeaturePresent.KERNEL32 ref: 0000000140097BEA

GetFileAttributesW.KERNEL32 ref: 00000001400B9C23
__std_fs_open_handle.LIBCPMT ref: 00000001400B9C4C
CloseHandle.KERNEL32 ref: 00000001400B9C5E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: Handle$AddressAttributesCloseErrorFeatureFileLastModulePresentProcProcessor__std_fs_open_handle
String ID:
API String ID: 156590933-0
Opcode ID: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction ID: 98aa0997b70f6753b76d58248d923b420046d08a402e457cad8a9bd5db08d6d2
Opcode Fuzzy Hash: ab22cb6cb8c17ed70bd3674071cc7aa31663a6931c8f4e60418ec3b925b4023f
Instruction Fuzzy Hash: E8117331214E4046FB625FA7A4C43AA6AB1E79D7F0F145614BB7747AF6DA38C4418F00

Function 00000001400ADC18 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400ADC44
GetCurrentThreadId.KERNEL32 ref: 00000001400ADC52
GetCurrentProcessId.KERNEL32 ref: 00000001400ADC5E
QueryPerformanceCounter.KERNEL32 ref: 00000001400ADC6E

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction ID: 0dd9dcacb845f48a253521ac83a2cca21c83a6a5bc2880636f7848e1445c12d8
Opcode Fuzzy Hash: f06392d29159ea5021ae0933302a5494cfde722d0989828b5d6bd782ea4d1856
Instruction Fuzzy Hash: 1F111532710B008AEB01CB62E8543A833A4F76DBA8F440E25EB6D877A4DF78C1A58350

Function 000000014002EAA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 000000014002EBDB

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 1889b773349bea32aa7d986dba9e2e9a900f4de924c1d0c1589eb58619d75cfc
Instruction ID: 05f359953e9b9669a5f2d794a8a924b0304dba2376285ed3a9963eee2ca0abb7
Opcode Fuzzy Hash: 1889b773349bea32aa7d986dba9e2e9a900f4de924c1d0c1589eb58619d75cfc
Instruction Fuzzy Hash: 2571E472B10B9085FB02CF7AD8513DD67A1E799BD4F544215EF5917BAADB78C482C300

Function 0000000140074EC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140074F2F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140074F77

Strings

bad locale name, xrefs: 000000014007504C

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 5f7c07f400263df17817c2433d4bfbc2a694bf5eff58aac397ae8a98a7cc8488
Instruction ID: 0ff5834fd7cccfed9dda83122226308b81dcbf88b767e808e74ea62672ff6e2c
Opcode Fuzzy Hash: 5f7c07f400263df17817c2433d4bfbc2a694bf5eff58aac397ae8a98a7cc8488
Instruction Fuzzy Hash: 9F51E932701A8089EB16DFB2D4903EC33A4FB59B88F444435FB4967AA6DF38C565D354

Function 0000000140054780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400547EF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140054837

Strings

bad locale name, xrefs: 0000000140054916

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: c85f5f4d0835978807908d786877568eeda184a6032ef30fff5fd87d8d9f5d51
Instruction ID: 19c40ac4ea62f52b551c1ca9be8750d2f0db8b92167cd4aa2704d10651e33b42
Opcode Fuzzy Hash: c85f5f4d0835978807908d786877568eeda184a6032ef30fff5fd87d8d9f5d51
Instruction Fuzzy Hash: 32512732702A809AEB16DFB2D4903EC33A4FB58788F444535FB4967AA6DF35C525D304

Function 00000001400A1068 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A6448: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A647B

_get_daylight.LIBCMT ref: 00000001400A1180
_get_daylight.LIBCMT ref: 00000001400A1191

Strings

?, xrefs: 00000001400A1111

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: ce26cdfa0ba9dc54c136b275a7ee5fff97ad7105a63be4f09223bdc61017f595
Instruction ID: 2cd9a1539d554dc540e9a82de50cf858f681d5926ac85a2294fa0341e4b9f859
Opcode Fuzzy Hash: ce26cdfa0ba9dc54c136b275a7ee5fff97ad7105a63be4f09223bdc61017f595
Instruction Fuzzy Hash: 9B41C53260878446FB669B27F5117EA66A0E7E8BE4F144325FF5847AF5DA38C4C1CB00

Function 000000014009AF20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014009B037
GetLastError.KERNEL32 ref: 000000014009B059

Strings

U, xrefs: 000000014009AFE3

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction ID: 340f031495362eb345ed01b47deeee5cd32316c87f3800ea0841bef917583308
Opcode Fuzzy Hash: 95c1b5a9b453dd21b53d1d3abd175e481a437f6821d85bbfa209bab1ceee3d57
Instruction Fuzzy Hash: BC41A072214A4086EB219F66E4543EA77A1F798BD4F414121FF4E87BA4EB7CC441CB50

Function 00000001400AF198 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400AF1E8
RaiseException.KERNEL32 ref: 00000001400AF229

Strings

csm, xrefs: 00000001400AF216

Memory Dump Source

Source File: 00000000.00000002.1766343157.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_chelentano.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction ID: 7a1b4bff0ea955f190068e43f7a33faa2e1f05678b2fca4cdbb4cbb64d7e996b
Opcode Fuzzy Hash: 4d2c4101b9d2858735cfea5a09a2e9289d44dfdbc7b24173af3d04f9105eea82
Instruction Fuzzy Hash: 9B11FB36214B8482EB628B16F44039977E5FB9CB94F584225EF8D07768DF3CC592CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report chelentano.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTPS Proxied Packets

Windows Analysis Report
chelentano.exe

Function 000000014007FB30 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 00007FF73F6E1F90 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1078
COMMON

Function 00000001400B98C0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF73F6D358C Relevance: 23.4, APIs: 9, Strings: 4, Instructions: 639
nativeCOMMON

Function 000000014003B820 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 0000000140076480 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 173
synchronizationCOMMON

Function 00000001400A114C Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 000000014007F200 Relevance: 13.9, APIs: 9, Instructions: 408
networkfileCOMMON

Function 00000001400BE968 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00000001400A13C8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Function 0000000140078B30 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Function 0000000140079BE0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 250
networkCOMMON

Function 0000000140083B30 Relevance: 13.6, APIs: 9, Instructions: 117
COMMON

Function 00007FF73F6E7F80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Function 000000014009D5F0 Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre